doubt-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands, including system utilities like
whichand external CLI tools such asgeminiandcodex. It includes specific security best practices such as avoiding shell interpolation by using temporary files and stdin piping. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting untrusted artifacts and contracts which are then passed to subagents or external models. The skill explicitly identifies the risk of prompt injection within these artifacts and recommends the use of read-only sandboxes for execution.
- Ingestion points: Untrusted code artifacts and architectural contracts extracted from the development environment (SKILL.md, Step 2).
- Boundary markers: Uses textual markers like
ARTIFACT:andCONTRACT:to delimit untrusted content within the review prompt. - Capability inventory: Spawning subagents for review; executing shell commands via external CLIs; file system access for writing temporary prompt files.
- Sanitization: Instructs the agent to avoid shell-quoted arguments to prevent command injection; recommends using stdin or heredocs; suggests read-only sandboxing for CLI tools.
Audit Metadata