designing-for-intent
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is restricted to read-only operations using Read, Grep, and Glob tools. It explicitly prohibits writing to or editing files in the procedure, minimizing the risk of unauthorized system modifications or persistence.
- [SAFE]: The skill implements a 'Trust-posture fence' that mandates a 'propose-and-confirm' model. It explicitly instructs the agent that high confidence in an inference must still only result in a proposal, never a silent action, which protects against autonomous agent overreach.
- [SAFE]: No external network dependencies, remote code execution patterns, or hardcoded credentials were found. All script and reference links point to local files within the skill package or the vendor's repository.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted artifacts (text, code, or PRDs) provided by the user to analyze intent. While this constitutes a vulnerability surface, the risk is minimal due to the lack of write/exec tools. 1. Ingestion points: Read and Grep tools acting on artifacts in SKILL.md. 2. Boundary markers: The procedure requires extraction into a specific Intent/Constraint YAML schema. 3. Capability inventory: Read-only access to files; no shell execution or file writing. 4. Sanitization: None mentioned, but the output is restricted to analysis reports.
Audit Metadata