recipe-implement
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the $ARGUMENTS variable and user-provided answers during the requirements phase to build a convergence record and determine the execution scale. This data influences the prompts and scope passed to downstream agents like the task-executor.
- Ingestion points: The $ARGUMENTS field and user responses to the orchestrator's hearing protocol.
- Boundary markers: No explicit delimiters or instructions to disregard embedded commands are present in the processing logic.
- Capability inventory: The orchestrator can execute Bash commands, perform git commits, delete files, and trigger complex workflows across multiple specialized agents with repository access.
- Sanitization: There is no evidence of input validation or sanitization before the data is used to parameterize the workflow.
- [COMMAND_EXECUTION]: The orchestrator uses shell commands via Bash to manage repository state through git commits and to perform cleanup by deleting temporary plan files in the docs/plans/ directory.
Audit Metadata