gather-requirements
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a structured workflow for requirements elicitation. It prioritizes reading existing project documentation (such as
README.md,CLAUDE.md, and/docs) to ground its recommendations in established codebase conventions. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it ingests untrusted user input (feature requests, Jira tickets). It mitigates this risk by requiring a mandatory sign-off gate where the agent must present the compiled requirements for user confirmation.
- Ingestion points: Raw feature requests and external documentation parsed in
SKILL.mdStep 2. - Boundary markers: Uses a rigid template in
references/requirements-template.mdto structure output. - Capability inventory: Performs file reads and writes; utilizes external search and context tools.
- Sanitization: Relies on the user interview process to clarify and validate interpretations before writing to the filesystem.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
tavilyMCP tool for web searches. This is a recognized service used for gathering technical documentation on libraries or APIs, and its use is scoped to providing context for the requirements document.
Audit Metadata