apply
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes multiple project files to drive its implementation and testing flow. If an adversary can modify these files (e.g., via a malicious pull request), they could embed instructions that manipulate the agent's behavior.
- Ingestion points: Step 2 and Step 3 read local files including
status.yaml,proposal.md,features/*.feature,design.md,tasks.md, andbeat/config.yamlto extract scenarios, criteria, and configurations. - Boundary markers: There are no explicit delimiters or boundary markers specified to segregate user-controlled data or external text content from the agent's core instructions.
- Capability inventory: The skill possesses powerful capabilities, including writing implementation and automated test code to the local filesystem, as well as executing shell commands via project-specific test runners (e.g.,
npx cucumber-js,behave). - Sanitization: No sanitization, escaping, or strict validation of the incoming markdown or Gherkin data is defined before processing or rendering.
Audit Metadata