duck-policy
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user requests and external project configuration files, creating a potential vector for indirect instructions.
- Ingestion points: The skill processes user input and project context files like CONTEXT.md as defined in the activation and precedence rules (SKILL.md).
- Boundary markers: The skill mitigates risks by requiring a multi-stage approval workflow (Checkpoints 1-4) where the user must verify the problem framing and the specific diff before execution (SKILL.md, assets/checkpoint-templates.md).
- Capability inventory: The agent is authorized to perform workspace-changing actions including code edits, file deletions, and command execution (SKILL.md, Checkpoint 3).
- Sanitization: The skill includes 'Safety carve-outs' that explicitly instruct the agent to refuse requests that would weaken security controls or validation (SKILL.md).
- [COMMAND_EXECUTION]: The instructions enable the agent to execute potentially sensitive system commands as part of its development workflow.
- Evidence: Checkpoint 3 in SKILL.md explicitly lists git commit, install, build, and deploy as mutating commands that require execution approval.
Audit Metadata