dev-rules
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and act upon data from external project sources such as PRDs, task trackers, and design documents. This creates a surface where an attacker could embed malicious instructions in these documents to influence the agent's behavior.
- Ingestion points: SKILL.md (Section 2) directs the agent to read canonical product and documentation sources to determine task scope.
- Boundary markers: While the skill requires the agent to cite the source and summarize the intended action, it does not specify technical delimiters (e.g., XML tags) to isolate untrusted content from system instructions.
- Capability inventory: The agent is authorized to perform Git operations (branch, commit, push, PR creation) and execute project-specific shell commands (bootstrap, install, prepare, codegen, migrations) as seen in SKILL.md (Sections 1 and 8).
- Sanitization: No explicit sanitization of external document content is described, though the skill mandates manual usability gates and user confirmation for behavior changes, providing human-in-the-loop review.
- [COMMAND_EXECUTION]: The skill workflow involves executing various shell-based project commands defined within the repository the agent is working on.
- Evidence: SKILL.md (Section 1) mentions running agent-specific commands, installation scripts, and code generation tools which execute code present in the project environment.
Audit Metadata