trellis-start
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script
python3 ./.trellis/scripts/get_context.pywith various flags (--mode phase,--mode packages,--step) to manage the development workflow. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by design, as it ingests and acts upon content from project-specific files.
- Ingestion points: The agent reads context from
.trellis/workflow.md,prd.md,design.md,implement.md, and various index files in the.trellis/spec/directory. - Boundary markers: There are no explicit instructions to use delimiters or ignore potentially malicious instructions embedded within these project documents.
- Capability inventory: The skill allows the execution of local Python scripts and the reading of local filesystem content within the
.trellisdirectory. - Sanitization: The skill does not describe any sanitization, validation, or filtering of the content retrieved from project files before it is processed by the agent.
Audit Metadata