work-define
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input and references external resources (Figma links, UI assets, and Markdown files) to produce User Stories that influence the behavior of downstream tools like /work-plan and /test-define.
- Ingestion points: User-supplied functional descriptions and design documentation in the assets/ directory as specified in SKILL.md and references/flow.md.
- Boundary markers: Instructions do not specify explicit delimiters or isolation for interpolated user data within the generated documentation.
- Capability inventory: File system writes, shell command execution (git branch), and invocation of platform skills (/work-plan, /test-define, /design-define).
- Sanitization: Implements a structured questions mechanism to clarify user intent and resolve ambiguities, which serves as a basic validation layer.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to inspect the local development environment status.
- Evidence: The command
git branch --show-currentis used in references/flow.md to ensure the agent is not operating in an implementation branch before creating new documentation files.
Audit Metadata