aiox-close-story
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill protocol requires the agent to "Load and execute po-close-story.md" located at
.aiox-core/development/tasks/po-close-story.md. This pattern treats the content of a local workspace file as a source of executable instructions. If the workspace or this specific file is tampered with (e.g., via a malicious Pull Request), the agent may execute arbitrary instructions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user which influences its behavior.
- Ingestion points: User-provided
$ARGUMENTS[0](story path) and$ARGUMENTS[1](mode) inSKILL.md. - Boundary markers: No delimiters or safety instructions are used to isolate these arguments from the rest of the task logic.
- Capability inventory: The skill has the capability to write to the file system (updating epic index and backlog) and execute instructions from local files.
- Sanitization: There is no evidence of validation or sanitization for the story path or mode arguments before they are used.
Audit Metadata