design-sprint
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of external packages from a GitHub repository (aoshimash/skills) using standard environment tools such as npx and Claude Code plugin commands.
- [COMMAND_EXECUTION]: The skill instructions utilize the gh (GitHub) and bee (Backlog) CLI tools for issue tracking tasks, which is consistent with the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local codebase and repository issue templates (SKILL.md) to perform research. The capability inventory includes subprocess calls for issue creation via external CLIs. A human-in-the-loop requirement serves as a sanitization step, as the agent is instructed not to publish content until the user has explicitly approved the exact plan and issue hierarchy.
Audit Metadata