requirements-lifecycle
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external project data such as tickets, specifications, and stakeholder feedback, creating a surface for potential indirect instructions. \n
- Ingestion points: The skill explicitly mentions reading 'existing tickets/specifications', 'project records', and 'user/task evidence' (SKILL.md, requirements-elicitation.md). \n
- Boundary markers: The instructions do not specify any delimiters or safety markers for separating external content from system instructions. \n
- Capability inventory: The skill does not include any scripts or executable code; agent capabilities are limited to the platform's default tools. \n
- Sanitization: No sanitization or validation steps for external content are described. \n
- [SAFE]: The skill contains no executable code, scripts, or configuration files that could facilitate command execution or data exfiltration. All files are purely instructional markdown.
Audit Metadata