zj-wayfinder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages project state by reading from and writing to external issue trackers (GitHub, GitLab) and processing research findings, which introduces a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the context from issue tracker comments, ticket descriptions, and external research results gathered by subagents (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing external content.
- Capability inventory: The skill can write to local markdown files, create or close issues on trackers, and invoke subagents (SKILL.md).
- Sanitization: There is no mention of sanitization or validation of the external content before it is used to influence the agent's decision-making or written to files.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local command-line utility.
- Evidence: The agent is instructed to run
roadmap_cli.py init/add/decideto integrate plan data into the roadmap system.
Audit Metadata