unified-workflow

Warn

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The instructions direct the agent to run npx claude-code-templates@latest --agent {category}/{name} --yes. This pattern downloads and executes code from the public NPM registry at runtime. The use of the --yes flag automatically accepts the package installation, removing a manual confirmation step for the user.
  • [COMMAND_EXECUTION]: The skill relies on a suite of commands using the bd CLI to manage a task lifecycle (epic, task, dependency, claim, close). It also requires the use of git for worktree management and branch finalization.
  • [DYNAMIC_EXECUTION]: The skill utilizes npx to dynamically fetch and execute specialist agent templates at runtime. The specific code executed is determined by variables provided during the workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a process that ingests external, potentially untrusted data.
  • Ingestion points: External task definitions passed to bd create and library documentation retrieved via mcp__context7__query-docs in the SKILL.md file.
  • Boundary markers: Absent. No delimiters are specified to isolate external task text or documentation content from the agent's internal instructions.
  • Capability inventory: The workflow involves shell access (bd, git, npx), file writes during TDD implementation, and execution of planning and debugging logic.
  • Sanitization: Absent. The skill does not describe any validation or filtering of external inputs before they are used to drive the brainstorming and planning phases.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 27, 2026, 08:59 AM
Security Audit — agent-trust-hub — unified-workflow