ss-feature-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (PRDs, requirement documents, and URLs) which could contain malicious instructions designed to influence the agent's orchestration logic.
- Ingestion points: The skill ingests a 'Requirement source' which can be a remote URL, a local file, or plain-text input (File: SKILL.md).
- Boundary markers: The instructions do not specify the use of clear delimiters or 'ignore' instructions when interpolating the external requirement content into the workflow context.
- Capability inventory: The skill possesses significant execution capabilities through the orchestration of sub-skills, including branch and worktree creation, file modification (proposals and plans), multi-agent code execution via
ss-coding, and pull request creation viass-create-pr(File: SKILL.md). - Sanitization: The skill explicitly relies on 'hard rules' and safety guardrails built into the downstream tools it calls, specifically mentioning that automation flags cannot bypass secret detection, force-push confirmations, or scope-overreach rejections.
Audit Metadata