build-executor
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from task briefs, implementer reports, and code diffs which are then interpolated into subagent prompts. This creates a surface for indirect prompt injection. 1. Ingestion points: [BRIEF_FILE], [IMPLEMENTER_REPORT_FILE], and code diffs in SKILL.md, task-reviewer-prompt.md, and implementer-prompt.md. 2. Boundary markers: Markdown headers serve as delimiters for the injected content. 3. Capability inventory: Executes local scripts via node and git, and performs file system writes for reports and receipts. 4. Sanitization: No explicit sanitization or escaping of ingested content is defined.
- [COMMAND_EXECUTION]: The skill executes a local script scripts/spec-superflow.mjs using node to manage the execution plan and verify tasks. It also uses git for retrieving diffs and committing changes.
Audit Metadata