feature-dev-auto
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill features an unattended implementation loop in Stage 4 that executes bash commands to verify goals. Although the initial goals are user-approved, the 'silent rearchitect' policy allows the agent to modify and execute new commands without further oversight if initial implementation attempts fail.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface by ingesting untrusted data from the repository being developed.
- Ingestion points: Local codebase files (SKILL.md, Stage 2) and user-supplied arguments.
- Boundary markers: Uses separate Architect and Evaluator agents to decouple implementation from verification, and requires explicit user sign-off on the plan file before Stage 4.
- Capability inventory: Full Bash execution, file modification, and sub-agent spawning capabilities are used throughout the workflow.
- Sanitization: No explicit logic is defined to sanitize codebase content or user inputs before they are processed by Architect agents or used to form generated Bash commands.
Audit Metadata