zj-roadmap-driven
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates project tracking through local storage and does not involve any external network communication or unauthorized data access.
- [COMMAND_EXECUTION]: Static analysis identified the use of
subprocess.runwithin the skill's test files (test_roadmap.py,test_roadmap_bundle.py,test_storage_advisor.py) and benchmark utilities. These instances are strictly used to invoke theroadmap_cli.pyscript locally for functional verification and do not pose a risk in the production execution environment. - [INDIRECT_PROMPT_INJECTION]: While the skill reads project data from external files (roadmaps), it employs robust validation including identifier regex matching (
NODE_ID_PATTERN) and state value enforcement. Additionally, the skill's operational instructions inSKILL.mddefine a 'Scope gate' to ensure the human user remains the final authority for project changes, mitigating risks of unintended autonomous actions triggered by roadmap content.
Audit Metadata