backlog-charter
Pass
Audited by Gen Agent Trust Hub on May 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script,
scripts/extract-signals.js, which executes thegit logcommand to extract project signals. This is used to bootstrap the capability specification process and is limited to local repository analysis.\n- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it ingests untrusted data from the repository (README, commits, and issues) to generate drafts.\n - Ingestion points: Repository files and git history are parsed by the
extract-signals.jsscript and instructions inSKILL.md.\n - Boundary markers: No specific delimiters are used for the ingested content, but the skill requires a human review ("interview") before any content is committed.\n
- Capability inventory: The skill allows writing to
CHARTER.mdandspec/capabilities.mdand executing localgitcommands.\n - Sanitization: There is no evidence of sanitization for the data read from the repository metadata.
Audit Metadata