tech-debt
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from several local JSON files, establishing an indirect prompt injection surface if those files contain data from untrusted sources (e.g., automated PR comments or external incident reports).\n
- Ingestion points:
data/engineering/tech_debt.json,data/engineering/tech_stack.json,data/engineering/engineering_scorecard.json, anddata/cfo/latest_forecast.json(defined in SKILL.md).\n - Boundary markers: None present to distinguish data from instructions.\n
- Capability inventory: The skill has the capability to write to the
data/engineering/tech_debt.jsonfile.\n - Sanitization: No validation or sanitization of the ingested data is performed.- [SAFE]: The skill's file access is limited to its own data directory and the requested files are relevant to its primary function as a technical debt analyst.\n
- Evidence: Reading
data/cfo/latest_forecast.jsonis a standard business context requirement for the stated purpose of impact-based prioritization.
Audit Metadata