brainstorming
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by ingesting untrusted content from the local environment and using it to guide agent behavior.
- Ingestion points: The skill instructs the agent to 'Check out the current project state first (files, docs, recent commits)' in SKILL.md.
- Boundary markers: The instructions lack delimiters or explicit warnings to ignore embedded instructions within the ingested project files.
- Capability inventory: The skill performs file system writes ('Write the validated design to docs/plans/...') and git operations ('Commit the design document to git') in SKILL.md. It also invokes other skills like 'superpowers:using-git-worktrees'.
- Sanitization: There is no evidence of sanitization or validation of the data retrieved from the project context before it is interpolated into the agent's reasoning process.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to interact with the system via file writes and version control commands.
- Evidence: Instructions include 'Write the validated design to docs/plans/YYYY-MM-DD--design.md' and 'Commit the design document to git'.
- Context: These operations are standard for a documentation and design tool, but are noted here as they represent the capability tier associated with the injection risk.
Audit Metadata