change-impact-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as code diffs, requirements, and dependency graphs provided by the user. While this creates an attack surface for indirect prompt injection, the skill includes instructions to separate facts from assumptions and report residual risks.
- Ingestion points: User-supplied materials (requirements, code diff, config changes) specified in
prompts/change-impact-analysis.md. - Boundary markers: The prompt lacks explicit delimiters for untrusted data but enforces a strict output heading contract.
- Capability inventory: The skill is restricted to analytical text processing and reasoning;
SKILL.mdexplicitly prohibits unauthorized production writes. - Sanitization: No specific sanitization or escaping of user-provided content is defined in the instructions.
- [SAFE]: The skill utilizes local scripts for automated evaluation and testing of the agent's analytical output. These scripts perform deterministic checks on output structure and content without executing external code or accessing sensitive files.
- [SAFE]: External references and documentation links point to repositories owned by the skill's author, representing legitimate vendor resources for documentation and examples.
Audit Metadata