progress-run
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill's primary function is to read and act upon external files such as
PLAN.mdorTODO.mdas authoritative instructions. This creates a surface for indirect prompt injection where malicious instructions embedded in a project's documentation could influence agent behavior. - Ingestion points: The agent is instructed to read plan files, handoff files, or
.pifiles from the repository. - Boundary markers: There are no explicit instructions to use delimiters or to disregard instructions contained within the ingested data.
- Capability inventory: The workflow allows the agent to inspect git status, read file contents, execute code slices, and modify files.
- Sanitization: No sanitization or validation of the input file content is performed before the agent treats it as authoritative.
- [NO_CODE]: The skill consists entirely of markdown instructions and YAML metadata. It does not include any standalone scripts, binaries, or third-party dependencies.
Audit Metadata