gsd-review-backlog
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bash commands to list backlog items, read planning documents, and manage directory structures. It also uses a wrapper function to call a vendor CLI tool for metadata updates and commits.\n- [DYNAMIC_EXECUTION]: The skill performs dynamic discovery of the
@opengsd/gsd-coretool by searching multiple platform-specific configuration directories (such as.claude,.cursor,.hermes, and others) and executing the resulting path usingnode.\n- [PERSISTENCE]: The skill attempts to persist the discovered tool's path by appending anexport PATHstatement to theCLAUDE_ENV_FILE, which ensures the tool is available in the environment for subsequent agent sessions.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from project files to process backlog items, creating a potential surface for indirect instructions.\n - Ingestion points: Reads
.planning/ROADMAP.md,CONTEXT.md, andRESEARCH.mdviacatandgrep.\n - Boundary markers: None identified; file content is used to populate variables like
${DESCRIPTION}.\n - Capability inventory: File system writes, directory deletion, and command execution via
nodeandbash.\n - Sanitization: No specific sanitization or escaping is performed on the data extracted from the local files before it is interpolated into shell commands.
Audit Metadata