quality-debt-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill follows best practices for AI agent skills, including explicit constraints against inventing data or metrics and emphasizing the use of least privilege for production or security-related work.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an ingestion surface for untrusted data (quality debt descriptions) to be analyzed by the agent. This is mitigated by explicit instructions in the prompt to perform an 'Input Audit', recording missing or conflicting information and separating confirmed facts from inferences.
- Ingestion points: User-provided scenarios describing system boundary cases, flaky tests, and stale data (e.g., in SKILL.md and prompts/quality-debt-analysis.md).
- Boundary markers: The instructions explicitly require the agent to use 'Input Audit' sections and separate 'Facts', 'Inferences', and 'Human decisions'.
- Capability inventory: The skill uses standard analytical reasoning; it does not contain network operations or arbitrary command execution instructions beyond local evaluation scripts used for testing.
- Sanitization: The prompt enforces a quality bar that prevents the agent from inferring numbers or system behavior without support, effectively sanitizing the output based on evidence strength.
Audit Metadata