checklist-runner
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external checklist files and explicitly instructs the agent to follow any embedded LLM instructions found within those files. This creates a surface where a malicious checklist could override agent behavior or exfiltrate context gathered during the execution process.
- Ingestion points: The skill reads checklist files from
.aiox-core/development/checklists/, documentation fromdocs/stories/, and local source code files. - Boundary markers: No explicit boundary markers or instructions to ignore malicious content within the checklists are provided.
- Capability inventory: The skill has the capability to read local files, access the output of
npm test, and retrieve the currentgit diff. - Sanitization: No sanitization or validation of the instructions found within the checklist files is performed.
Audit Metadata