change-design-gate
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user instructions and external data (Issues, logs, source code) to generate design documents. It includes a specific adversarial instruction to never treat content from the skill itself as safety conclusions.
- Ingestion points: Processes user requests, GitHub Issues, and repository files via
github-issue-flowand standard file tools. - Boundary markers: Explicitly instructs the agent to separate 'Facts', 'Estimates', and 'Unconfirmed' data in Phase 1.
- Capability inventory: Writing files, creating GitHub Issues, reading repository content.
- Sanitization: The skill does not perform code execution of external inputs; it transforms them into static HTML documentation for human review before any implementation occurs.
- [COMMAND_EXECUTION]: The skill defines a strict boundary where no implementation-related commands (git commit, push, deploy, DB writes) are permitted until a human explicitly approves the design document produced in a separate, non-tracked directory (
work/design-reviews/). - [DATA_EXFILTRATION]: While the skill reads repository data (logs, config, source), it restricts network operations. It specifies that the generated HTML must not use external CDNs or network access. Data is kept within the local repository's untracked design directory. The only outbound communication is a one-time Issue creation via an authorized tool, following standard developer workflows.
- [OBFUSCATION]: Analysis of the markdown and HTML templates found no hidden characters, homoglyphs, or encoded payloads. The HTML template uses standard CSS and inline SVG for diagrams, specifically avoiding external dependencies that could facilitate tracking or exfiltration.
Audit Metadata