recipe-fullstack-implement
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data which is then used to drive logic and influence the execution of subagents with significant capabilities.
- Ingestion points: User instructions are ingested through the
$ARGUMENTSvariable in the situation assessment phase and via the "user's retained wording" during the requirement convergence phase inSKILL.md. - Boundary markers: While the skill uses structured tables and checklists for logic, it lacks explicit boundary markers (such as XML tags or specific delimiters) to isolate untrusted input from the orchestrator's core instructions.
- Capability inventory: The skill coordinates high-privilege operations including code execution via subagents (e.g.,
task-executor), file system modifications (deleting task files indocs/plans/tasks/), and version control operations (commits). - Sanitization: There is no evidence of sanitization, escaping, or validation of the user-provided text before it is used to judge "convergence" or determine the "Structural Scale" of the implementation.
Audit Metadata