doubt-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to invoke external command-line interfaces such as
geminiandcodex. It proactively addresses shell injection risks by instructing the agent to use temporary files and stdin pipes rather than direct shell interpolation for potentially unsafe artifact content. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external 'artifacts' (such as code or documentation).
- Ingestion points: Untrusted data enters the context via the
ARTIFACTandCONTRACTfields inSKILL.mdduring the 'DOUBT' step. - Boundary markers: The instructions use explicit delimiters (
ARTIFACT:,CONTRACT:) to separate reviewable units from the agent's internal reasoning. - Capability inventory: The orchestrator utilizes subprocess calls (
which,gemini,codex) and file-write operations to manage temporary review data. - Sanitization: The skill recommends using a read-only sandbox for tool execution and warns against interpolating artifacts directly into shell-quoted arguments to prevent instruction leakage.
- [REMOTE_CODE_EXECUTION]: The process involves calling external AI models via CLI tools. While these are legitimate tools from well-known providers, the execution path relies on local binaries and network communication with external APIs. The skill mandates checking for binary integrity (version checks) and confirming specific configurations with the user before execution.
Audit Metadata