recap-doc
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, such as source code, git logs, and commit messages, to synthesize reports. It mitigates potential injection risks through a mandatory security redaction step and clear prompt boundaries.\n
- Ingestion points: Untrusted content enters the agent context through the Read tool (source files, tech specs) and Bash output (git logs, diffs), as described in references/source-guide.md and SKILL.md Phase 2.\n
- Boundary markers: The prompt template in references/prompt-template.md utilizes {{VARIABLE}} interpolation to separate instructions from collected data.\n
- Capability inventory: The skill utilizes Write for document generation, Bash for git research, and Read/Grep/Glob for codebase exploration.\n
- Sanitization: A pre-write redaction phase using scripts/security-redact.js is enforced to scan for and mask secrets or credentials before any file is saved to disk.\n- [COMMAND_EXECUTION]: The skill performs shell execution to retrieve git evidence, including commit history and diff statistics. These operations are restricted to git:* and node:* tools within the allowed-tools configuration, minimizing the risk of arbitrary command injection.\n- [DATA_EXFILTRATION]: The skill includes robust path security controls to prevent unauthorized data access. It enforces a write boundary that limits output to the repository root or the system temporary directory, utilizing fs.realpathSync to validate canonical paths and prevent directory traversal or symlink attacks.
Audit Metadata