roadmap
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to the ingestion of untrusted thread data that is used to generate file content.
- Ingestion points: The skill reads external, potentially attacker-controlled content from
seed.md,change.md, and files within thedelta/directory (SKILL.md). - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" directives when interpolating thread-local data into the roadmap index.
- Capability inventory: The skill possesses file-write capabilities, creating directory structures and authoring files under
.work/roadmaps/(SKILL.md) and.pending-decisions/(references/instructions/emit-pending-decisions.md). - Sanitization: There is no evidence of input validation, escaping, or filtering of the content gathered from the thread artifacts before it is used to author the project-level index.
Audit Metadata