land
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from specification files to automate documentation updates and PR generation.
- Ingestion points: Untrusted data enters the context via specification files at
docs/specs/<slug>.mdand repository diffs as described in the verification process. - Boundary markers: The skill utilizes a "fresh subagent" for initial verification which provides an isolation layer to prevent the primary agent from following instructions embedded in the spec. However, it lacks explicit delimiters when interpolating spec content into PR bodies and commit messages.
- Capability inventory: The skill has the capability to perform git merges, delete branches, remove worktrees, and modify persistent repository files such as
CONTEXT.mdandARCHITECTURE.md. - Sanitization: The instructions do not specify any sanitization or escaping of the content read from specification files before it is written to the git history or documentation.
Audit Metadata