superwork
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests task definitions and verification commands from files within the repository, such as PLAN.md, plans/*.md, or SPECS.md. This creates a surface for indirect prompt injection if these files are modified by an untrusted party.
- [INDIRECT_PROMPT_INJECTION]: Ingestion points: The skill frames its entire workflow based on content read from plan files (SKILL.md, Section: Frame).
- [INDIRECT_PROMPT_INJECTION]: Boundary markers: The skill requires user confirmation of the phase list and verification criteria before execution, but does not implement specific delimiters or safety warnings for the untrusted content itself (SKILL.md, Section: Frame).
- [INDIRECT_PROMPT_INJECTION]: Capability inventory: The skill possesses capabilities to mutate the repository, execute shell commands, and delegate tasks to subagents (SKILL.md, references/loop.md, references/subagents.md).
- [INDIRECT_PROMPT_INJECTION]: Sanitization: No explicit sanitization or strict schema validation for the input files is described.
- [COMMAND_EXECUTION]: The skill is designed to execute arbitrary commands specified in repository files (e.g., build, test, lint, scripts) to verify phase completion (references/loop.md).
Audit Metadata