david-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external, potentially untrusted sources including pull request review comments, CI/CD check outputs, and trace data from an external monitoring tool (Maple MCP).
- Ingestion points: PR review comments, CI failure reports, and performance trace data retrieved via the Maple MCP tools (e.g.,
search_traces,inspect_trace). - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed data are defined in the workflow.
- Capability inventory: The skill possesses extensive capabilities across all implementation scripts, including file modification, PR management (opening and updating via
gh), and shell command execution (bun,infisical). - Sanitization: There is no evidence of sanitization or validation of instructions received through review comments before the agent attempts to 'Fix every finding'.
- [COMMAND_EXECUTION]: The workflow grants the agent significant autonomy, specifically instructing it to 'Open the PR without asking' and 'run every phase to the end without stopping to ask whether to continue'. This reduces human oversight during the execution of shell commands and repository modifications.
Audit Metadata