apply-qa-fixes
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run standard development lifecycle commands (
npm run lint && npm run typecheck && npm test) to verify fixes. These are expected behaviors for an agent scoped to the 'dev' role within a software project environment. - [DYNAMIC_EXECUTION]: The protocol specifies to 'Load and execute apply-qa-fixes.md'. In the context of this agent framework, this refers to following the instructions contained within a local task definition file located at
.aiox-core/development/tasks/apply-qa-fixes.md. This is a routine task-orchestration pattern. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes external data (QA gate findings/files) and takes a user-supplied
story-pathargument. - Ingestion points: Reads content from files associated with the user-provided
$ARGUMENTS[0](story path) and the QA Results gate file. - Boundary markers: None explicitly defined in the instructions to separate data from instructions.
- Capability inventory: Subprocess execution via
npmcommands. - Sanitization: Not specified; the agent is expected to interpret the findings as tasks to perform.
Audit Metadata