gsd-quick
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill captures user input via the
{{GSD_ARGS}}placeholder to define task parameters for sub-agents. \n - Ingestion points: User input following the
$gsd-quicktrigger is captured in the{{GSD_ARGS}}variable withinSKILL.md. \n - Boundary markers: The skill instructions do not define specific delimiters or guardrail instructions to isolate the user-interpolated input from the agent's internal logic. \n
- Capability inventory: The skill utilizes the
spawn_agenttool to create sub-tasks and is designed to perform filesystem writes, including atomic commits and state tracking inSTATE.md. \n - Sanitization: No sanitization, filtering, or validation of the input arguments is described in the skill's processing logic. \n- [COMMAND_EXECUTION]: The skill references a local file at a hardcoded absolute path (
C:/Users/nicol/.codex/get-shit-done/workflows/quick.md) for its execution context and process definition. This creates a dependency on a specific local environment and file structure.
Audit Metadata