propagate-design-change
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and analyzes content from Game Design Documents (GDDs) and Architectural Decision Records (ADRs) to identify stale decisions.\n
- Ingestion points: Phase 2 and Phase 4 read full document contents from
design/gdd/anddocs/architecture/.\n - Boundary markers: There are no explicit instructions to the agent to treat document content as untrusted or to use delimiters to prevent instruction injection.\n
- Capability inventory: The skill has file-writing capabilities, can execute shell commands, and can spawn other agents via the
Tasktool.\n - Sanitization: No sanitization or validation of the ingested text is performed before it is used to influence the workflow.\n- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill executes a git command that incorporates a user-supplied file path.\n
- Evidence: In Phase 3, the command
git show HEAD:design/gdd/[filename].mdis executed using theBashtool.\n - Discussion: While the skill verifies the file's existence on disk before execution, constructing shell commands from user-provided input is a potential injection vector.
Audit Metadata