implement-and-review
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/launch.pyexecutesgitcommands for worktree management and invokes other local Python runners (e.g.,codex-runner,claude-runner) viasubprocess.run. This is used to automate the multi-track implementation and testing workflow. - [DYNAMIC_EXECUTION]: The skill dynamically resolves the paths of local runner scripts based on the skill's installation directory at runtime. It then executes these scripts using
sys.executableto perform implementation and review tasks. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data, such as task prompts, issue briefs, and 'Slice Contracts'. This data is interpolated into briefs for subagents that possess significant capabilities, including file modification and command execution.
- Ingestion points: Task descriptions and Slice Contracts are loaded into the agent context during Phase 0.
- Boundary markers: The skill uses methodology snippets to structure subagent briefs, but does not implement strict delimiters or 'ignore embedded instructions' warnings for user-provided content.
- Capability inventory: The subagents and runners are granted file-write permissions and the ability to execute terminal commands (e.g., build and test scripts).
- Sanitization: The skill lacks explicit sanitization or filtering of external content before it is processed by the implementation seats.
Audit Metadata