development-contract-repo-overlay-template
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process local repository files, such as policy definitions, checker scripts, and lifecycle helpers, to generate documentation overlays. This represents an indirect prompt injection surface if the target repository contains malicious content.
- Ingestion points: Target repository policy files, checker command definitions, lifecycle helpers, and validation profiles (SKILL.md).
- Boundary markers: None explicitly mentioned in the instructions to delimit untrusted file content.
- Capability inventory: The skill allows the agent to write repository-local overlays (documentation/config files) and execute repository-specific checker commands (SKILL.md).
- Sanitization: The skill does not define specific sanitization or validation logic for the content read from the repository files.
Audit Metadata