ai-done
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in Step 5 require the agent to execute a 'rehearsed rollback' using the Bash tool and capture real command output as evidence. This involves running user-defined or project-specific commands which could be dangerous if misconfigured or if the environment is untrusted.
- [INDIRECT_PROMPT_INJECTION]: Step 6 (L5 Post-ship eval loop) describes a process where production outputs from the AI feature are sampled and fed back into an evaluation suite. This creates an indirect prompt injection surface where malicious or adversarial AI outputs could potentially influence the agent's evaluation results or instructions if they contain embedded commands or instructions that the evaluation suite (/eval-harness) parses.
- Ingestion points: Production logs, database tables, or storage volumes containing AI-generated outputs (SKILL.md Step 6).
- Boundary markers: None explicitly defined in this skill; it relies on the /eval-harness skill for the actual grading process.
- Capability inventory: The skill uses Bash, Write, Edit, Grep, and Glob tools which provide significant file system access and shell execution capabilities.
- Sanitization: No specific sanitization, filtering, or escaping of the ingested production data is mentioned in the skill instructions.
Audit Metadata