audit
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project documentation and configuration files to generate quality reports and recommend follow-up commands.
- Ingestion points: Processes implementation code, design tokens, PRODUCT.md, DESIGN.md, .impeccable.md, and .github/copilot-instructions.md as specified in SKILL.md.
- Boundary markers: The instructions do not define clear delimiters or include directives for the agent to ignore instructions that might be embedded within these external project files.
- Capability inventory: The skill is limited to report generation and recommendation. It does not have permissions or instructions to write to the file system or perform network operations within its own scope.
- Sanitization: There is no evidence of sanitization or validation for the content retrieved from the ingested design and documentation files.
Audit Metadata