Electrobun SDLC
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions define an 8-stage pipeline where data is passed verbatim between different agents. This creates an indirect prompt injection surface where a malicious feature description or intermediate report could influence the behavior of downstream agents that possess file-writing capabilities.
- Ingestion points: Stage 1 accepts an untrusted user feature description; each subsequent stage consumes the verbatim output (reports and specs) of the previous agents.
- Boundary markers: No boundary markers or delimiters (such as XML tags) are specified for the documents passed between agents; the orchestrator is explicitly told to pass documents verbatim.
- Capability inventory: Several agents in the pipeline (ui-agent, backend-agent, alignment-agent, docs-agent) are empowered to write and modify files in the project directory, including source code, configuration files, and documentation.
- Sanitization: The skill does not mention any sanitization, validation, or escaping of the data being handed off between the specialized agents.
Audit Metadata