backend-delivery-loop
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard local development commands, including git operations (git status, git diff, git stash) and project-specific scripts found in package.json (e.g., jest, vitest, npm test). These are standard and necessary operations for a developer agent.
- [DATA_EXFILTRATION]: The skill reads project source code, configuration files, and server logs to facilitate diagnostics and reviews. It also manages a specification vault via SPEC_VAULT_PATH, which may involve syncing data from an upstream repository. These operations occur within the legitimate scope of a development orchestrator.
- [PROMPT_INJECTION]: The skill has an architectural surface for indirect prompt injection as it processes untrusted content from the repository (source code, git diffs, and specifications) and incorporates it into instructions for subagents. 1. Ingestion points: Content from the repository including code, diffs, logs, and OpenSpec artifacts (proposal.md, specs/). 2. Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted data when passing it to subagents. 3. Capability inventory: Execution of shell scripts and dispatching of specialized subagents with broad capabilities. 4. Sanitization: The skill does not explicitly perform sanitization or validation on the data read from the project before using it in the agent loop.
Audit Metadata