aiox-full-sdc
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes the 'aiox' command-line tool to manage the story development cycle.
- Evidence includes commands like 'aiox sdc plan', 'aiox sdc preflight', and 'aiox sdc verify'. These are part of the vendor's (synkraai) infrastructure for orchestrating agent tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided story paths which may contain untrusted data.
- Ingestion points: Path inputs are received via the '{story-path}' argument in SKILL.md.
- Boundary markers: The skill implements a 'mandatory mechanical gate' using the 'aiox sdc preflight' command to validate the outgoing prompt and context before execution.
- Capability inventory: The skill has the ability to execute CLI commands and spawn subagents (aiox-po, aiox-dev, aiox-qa).
- Sanitization: Validation is performed by the 'preflight' tool, which checks the budget and intent files against governance rules (returning exit code 5 on rejection).
Audit Metadata