work
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from task specifications and member preference files.\n
- Ingestion points: Data enters the agent context through reading
spec.md,state.md, and individual member preference configurations within the.devflow/team/directory.\n - Boundary markers: Strict boundaries are defined in
references/work-state.mdandSKILL.md, and the skill explicitly warns that personal preferences must not override core project contracts or security permissions.\n - Capability inventory: The skill possesses the capability to modify project files, perform Git operations, and execute external checks via the
runChildfunction.\n - Sanitization: All file operations are subject to path validation in
scripts/runtime/common.mjsto prevent directory traversal outside the project root. The skill also performs artifact integrity verification using SHA256 hashes.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of build or test commands as part of the implementation cycle.\n - Evidence: The
runChildfunction inscripts/runtime/common.mjsusesnode:child_processto spawn subprocesses for verification. This execution is limited by a 10-second timeout and a 4MB output limit to prevent denial-of-service or memory issues.\n- [DATA_EXFILTRATION]: The skill reads project-level metadata and member preferences, which could potentially contain user-specific context.\n - Evidence: The agent is instructed to read files within the
.devflow/directory, including team-specific context and member preferences. However, these operations are confined to the local project environment, and the skill does not include any network-based exfiltration capabilities.
Audit Metadata