graph
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The progress dashboard generated by the skill loads the Mermaid.js library from the well-known jsDelivr CDN to render visual task dependency graphs. This is a neutral finding and follows standard development practices for dashboarding.
- [PROMPT_INJECTION]: The skill ingests external data (such as PRDs, SPEC files, and issue descriptions) and interpolates this content into prompts for subagents, creating an indirect prompt injection surface.
- Ingestion points: Task descriptions, PRD/SPEC files, and GitHub issue bodies processed during the decomposition phase.
- Boundary markers: The prompt template defined for subagents lacks explicit delimiters or instructions to ignore potential commands embedded within the interpolated task data.
- Capability inventory: The skill and its subagents possess capabilities for file system modification, git repository management, and pull request creation.
- Sanitization: The skill does not perform specific validation or sanitization of the input text before passing it to subagents.
Audit Metadata