fest-methodology
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
festCLI for all project management operations (e.g.,fest next,fest create,fest validate). These commands are executed locally to manage the project state and are consistent with the skill's stated purpose of providing a methodology model. - [INDIRECT_PROMPT_INJECTION]: The skill processes markdown-based task files as part of its workflow. These files represent an ingestion point for potentially untrusted content if the project data is sourced externally.
- Ingestion points: Reads task files (e.g.,
NN_lower_snake_case.md) within thefestivals/directory. - Boundary markers: None specified in the methodology instructions.
- Capability inventory: Executes shell commands via the
festCLI and performs filesystem operations. - Sanitization: No sanitization of task file content is explicitly described in the methodology.
Audit Metadata