uw-build
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill dynamically computes its own installation directory by searching the user's home directory (
$HOME/.claude/plugins/cache/) and subsequently sources shell scripts and executes Node.js modules from that path. While this is used for self-bootstrapping, the use of computed paths for code execution is a sensitive pattern. - [INDIRECT_PROMPT_INJECTION]: The skill reads external configuration files (e.g.,
REBUILD-PLAN.md,rebuild-decisions.json) and interpolates their contents into prompts for subagents without explicit sanitization. This could allow maliciously crafted local files to influence the behavior of the builder agents. - Ingestion points: Local files in the
docs/unwind/directory, including the plan, decisions, and layer specifications. - Boundary markers: Data is interpolated into a task prompt with headers but lacks strict escaping or ignore-instruction warnings.
- Capability inventory: The skill has the ability to write to the file system, execute shell commands (git, node, pnpm), and dispatch autonomous subagents.
- Sanitization: There is no evidence of validation or sanitization for the content read from files before it is used in prompts.
Audit Metadata