quality-management
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from multiple untrusted external sources.
- Ingestion points: The skill reads data from numerous project JSON files, including
specs-quality.json,inspection-tracker.json,sub-performance.json,daily-reports.json,plans-spatial.json,directory.json,quality-data.json, andprocurement-log.json(referenced inSKILL.md). - Boundary markers: No explicit boundary markers or instructions to disregard embedded commands within the ingested data were identified.
- Capability inventory: The skill performs file read operations and data processing to generate checklists and reports. No high-risk capabilities such as network access, file writing, or subprocess execution were detected in
SKILL.mdorreferences/skill-detail.md. - Sanitization: There is no evidence of input validation, escaping, or filtering of the external JSON content before it is processed and presented to the agent.
Audit Metadata