work
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently invokes local CLI tools (lev, bd, br, td, cm, cass, git) to manage workstreams, perform searches, and handle file operations. These tools are central to its operation as a workflow orchestrator.
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto initialize and run thelevstack tool. This involves downloading and executing packages from the npm registry, which is a standard developer practice but introduces an external dependency. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it ingests data from project files, git history, and external research reports to generate prompts for subagents during the execution phase.
- Ingestion points: Reads content from codebase searches, documentation, research beads, and external search results.
- Boundary markers: Implements structured 'bead' artifacts and report templates to manage state and evidence transitions.
- Capability inventory: Possesses capabilities to write files, perform git commit/push operations, and execute multiple system commands via its toolset.
- Sanitization: Relies on a 'guard scoring' system to detect underspecified objectives and 'validation gates' (e.g., gate:spec-execute) to verify specifications before execution.
- [DYNAMIC_EXECUTION]: Utilizes a 'FlowMind' spec engine that dynamically generates system prompts and executable contracts from YAML-based flow definitions.
Audit Metadata