roadmap-sync
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script located at
bin/cli.jswithin theroadmap-skilldirectory to perform roadmap initialization, generation, and synchronization tasks. - [PROMPT_INJECTION]: The skill features an indirect prompt injection surface because it ingests and processes data from various repository files to validate the status of roadmap items.
- Ingestion points: Scans source code, tests, documentation, and TODOs within the repository files (SKILL.md).
- Boundary markers: No specific delimiters or safety instructions are defined to distinguish ingested data from instructions.
- Capability inventory: The skill has the capability to read local project files, execute scripts via Node.js, and write to the
ROADMAP.mdfile (SKILL.md). - Sanitization: No evidence of sanitization, escaping, or validation of the content extracted from repository files is provided.
Audit Metadata