trellis-continue
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script (
python3 ./.trellis/scripts/get_context.py) with various flags to retrieve task state, git context, and workflow routing information. This is standard behavior for project management tooling. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it instructs the agent to make routing decisions based on the presence and content of external files such as
prd.md,design.md, andimplement.md. - Ingestion points: Content of project documentation files (
prd.md,design.md) and the.trellis/workflow.mdfile. - Boundary markers: None explicitly defined in the skill instructions.
- Capability inventory: Execution of a local Python context script via
python3. - Sanitization: None described in the prompt text; safety depends on the implementation of the
get_context.pyscript and the agent's internal guardrails when parsing user-generated project files.
Audit Metadata