story-done
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from story files and architectural documents without explicit sanitization. This presents an indirect prompt injection surface where malicious content in those files could influence the agent's decision-making or tool usage.
- Ingestion points: Story files (.md),
tr-registry.yaml, and Architecture Decision Records (ADRs). - Boundary markers: None detected in the instructions.
- Capability inventory: Access to
Bash(shell execution),Write/Edit(filesystem modification), and backlog management tools. - Sanitization: No sanitization or validation of the extracted data is described before use.
- [COMMAND_EXECUTION]: The skill automatically executes shell commands via the
Bashtool based on test file paths extracted directly from markdown story files. This mechanism is susceptible to command injection if a story file contains shell metacharacters in the test path fields.
Audit Metadata