interview
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill references a hardcoded absolute local path "/Users/jean-patricksmith/.agents/skills/work/templates/design.md" in the process contract for loading design templates. This exposes the local username and directory structure of the developer to any agent using the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local workspace to synthesize design requirements and generate files, creating a potential vector for indirect prompt injection.\n
- Ingestion points: Reads code, documentation, designs, and proposals during workspace exploration in the "discover_context" and "orient_subject" steps (SKILL.md).\n
- Boundary markers: The instructions lack explicit delimiters or safety warnings to ignore instructions embedded within the ingested workspace files.\n
- Capability inventory: The skill has authority to write artifacts to ".lev/pm/designs/", update vocabulary files, and create architecture decision records (ADRs) in the "docs/adr/" directory (SKILL.md).\n
- Sanitization: There is no evidence of sanitization or validation of the content pulled from the workspace before it is used to generate or modify files.
Audit Metadata