lean-build
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists of instructional text for guiding an AI agent through a 'lean build' development process. No executable code, shell commands, or network operations are present within the skill files.
- [SAFE]: The
THIRD_PARTY_NOTICES.mdfile correctly attributes the source of the instructions to a public GitHub repository and includes standard license texts. The URLs provided are plain-text and point to legitimate development resources. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external inputs by deriving acceptance criteria from user requests and repository content.
- Ingestion points: Instructions in
SKILL.mddirect the agent to ingest data from user 'request' and the 'repository'. - Boundary markers: None explicitly specified to separate instructions from processed data.
- Capability inventory: The skill implies file modification ('Refactor code', 'Add surface, dependency, service') and execution ('Run focused proof') within a development environment.
- Sanitization: No specific sanitization or validation steps are defined for the ingested data. This surface is inherent to the skill's primary purpose of software development.
Audit Metadata