recipe-build
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external files and user arguments to drive an autonomous execution pipeline. \n
- Ingestion points: Untrusted data enters the agent context through the $ARGUMENTS variable and by reading markdown files from the docs/plans/, docs/plans/tasks/, and docs/design/ directories. \n
- Boundary markers: The instructions do not define explicit delimiters or 'ignore embedded instructions' blocks when interpolating external file content into prompts for sub-agents like task-decomposer or task-executor. \n
- Capability inventory: The skill possesses significant capabilities, including writing to the file system, deleting files in the docs/plans/tasks/ directory, and performing git commit operations. \n
- Sanitization: There is no evidence of sanitization, escaping, or strict schema validation for the external documents before their contents are processed by the orchestrator.
Audit Metadata