answer-notes-loop
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a shell script for file monitoring that interpolates user-supplied arguments (feature names and file stems) directly into a shell command string. This creates a risk of command injection if the inputs are not sanitized by the agent before the script is executed.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external revision notes and project principles to generate document updates, creating an attack surface where embedded instructions could influence agent behavior. 1. Ingestion points: Revision notes files at
docs/<feature>/<STEM>.revN.notes.mdand project-level principle files likePRINCIPLES.md. 2. Boundary markers: No delimiters or warnings are used to distinguish external content. 3. Capability inventory: The agent can execute shell scripts and write files to the local system. 4. Sanitization: The content of ingested files is not sanitized or validated before processing.
Audit Metadata