ss-multi-repo-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of untrusted external content.
- Ingestion points: The skill processes PRD links, issue tracker links, and plain-text requirements as described in the 'Inputs' and 'Input Type Detection' sections of SKILL.md.
- Boundary markers: There are no explicit instruction delimiters or 'ignore embedded instructions' warnings present in the orchestrator to isolate user-provided requirement text from the execution logic.
- Capability inventory: The skill manages subprocesses through 'headless process' or 'native child' adapters, performs file writes (distributing sub-plans), and conducts network operations via Git and PR-hosting CLI tools (
gh,glab). - Sanitization: No evidence of sanitization, escaping, or validation of the external requirement content is specified before it is interpolated into sub-plans and passed to per-repo execution runners.
- [COMMAND_EXECUTION]: The skill dynamically executes repository-scoped runners using a variety of process adapters.
- Evidence: The 'Runner adapter' input and 'Launch a batch' process in SKILL.md define how the orchestrator launches
ss-coding-workflowin separate directories. - Context: While the skill provides architectural guardrails—such as Iron Rules that prevent the orchestrator from editing source code directly and Pre-flight Checks to verify repository paths—it fundamentally relies on the dynamic execution of nested agent sessions in the host environment.
Audit Metadata