understand
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the repository, including project files (PROJECT.md, AGENTS.md), error logs, and existing documentation in
docs/flows/. These files could contain hidden instructions to manipulate the tracing process. - Ingestion points: SKILL.md (Process section) instructs the agent to read external files, linked documents, and project metadata.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external file content as untrusted data.
- Capability inventory: The skill executes
git diffcommands and writes documentation to thedocs/flows/directory. - Sanitization: No sanitization or validation of the ingested content is performed before it is used to influence the agent's logic.
- [COMMAND_EXECUTION]: The skill executes
git diff --stat <commit> -- <files>using data parsed directly from flow files. If the commit hash or file paths in a flow file are maliciously crafted, they could attempt to inject arguments into the git command.
Audit Metadata