pm-frontend-prototype
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external project data, which introduces a surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read existing project source code, adjacent pages, routing configurations, and product documentation stored in
docs/product/(SKILL.md, Section IV.1). - Boundary markers: The instructions do not define specific delimiters or warnings to prevent the agent from following instructions that might be embedded within these analyzed files.
- Capability inventory: The agent possesses the capability to write new source code files, modify project structure, and execute shell commands to run local development servers (SKILL.md, Section XI).
- Sanitization: There are no documented procedures for sanitizing or validating the content read from external project files before processing.
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute local system commands to verify the prototype.
- Evidence: Step 6 of the implementation flow (SKILL.md, Section XI) explicitly instructs the agent to "Actually run project" and "Start existing local development service." This involves executing build and start scripts (e.g.,
npm run dev) within the user's local environment.
Audit Metadata