validate-direction
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is the analysis of existing project documentation, code, and conversation context. It generates structured markdown reports to assist in decision-making.
- [DATA_EXPOSURE]: The 'Persisted' branch writes validation artifacts (briefs, reports, and verdicts) to the OS temporary directory (
$TMPDIRor%TEMP%). This is a standard practice for temporary file management and does not constitute unauthorized data exposure in this context, as no external exfiltration is attempted. - [COMMAND_EXECUTION]: The skill uses subagents for independent analysis but does not invoke shell commands, execute scripts, or perform system-level modifications.
- [PROMPT_INJECTION]: While the skill ingests untrusted data (PR context, external research), its instructions focus on critical analysis and reporting rather than execution. The risk of indirect prompt injection is low as the output is descriptive text rather than executable commands.
Audit Metadata