techlead
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/validate_artifacts.py) to validate the structure, requirement IDs, and coverage gates in the generated PRD.md and TASKS.md files. The script uses only Python standard libraries and performs static analysis on the markdown content. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input during the brainstorming interview to generate project documentation. It mitigates risks by using structured HTML markers and templates to maintain document integrity, and by restricting its actions to file writing and structure validation. It explicitly instructs the agent to avoid implementing application code unless requested after plan approval.
Audit Metadata