aep-human-alignment
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Several scripts (derive.mjs, pulse.mjs, scan-workspace.mjs) execute git commands via execFileSync to extract repository metadata, commit history, and file contents.
- [REMOTE_CODE_EXECUTION]: The loadYaml function in derive.mjs and coherence.mjs attempts to use local YAML parsers but falls back to fetching the js-yaml package from the npm registry using npx --yes js-yaml.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from product-context.yaml and repository metadata to generate human-readable prose. Malicious content within the YAML file could potentially influence the agent's output during the authoring phase, although the skill includes a mechanical audit (audit.mjs) to enforce data-binding rules. 1. Ingestion points: product-context.yaml (parsed in derive.mjs, census.mjs, coherence.mjs), manifest.json (parsed in assemble.mjs). 2. Boundary markers: The system uses a specific template assets/template.html and requires the agent to bind numbers to a derived facts.json using data-fact attributes. An independent audit script (audit.mjs) verifies these bindings. 3. Capability inventory: The skill can read repository data via git, perform workspace scans, and write HTML artifacts to the local file system. 4. Sanitization: The assemble.mjs script uses safeJson to escape script tags when injecting data into the HTML template.
Audit Metadata