kstack-root-driven-development
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill establishes an instructional framework for a highly controlled development lifecycle. It prioritizes user agreement on requirements and phases, preventing the agent from proceeding without explicit authorization.
- [SAFE]: The workflow incorporates robust security practices, such as separating implementation (root) from verification (subagents) and requiring multiple automated reviews (drift-review, skill-review) before human review.
- [INDIRECT_PROMPT_INJECTION]: As a development tool, the skill is designed to process and act upon repository content and user feedback. While this presents an attack surface, the workflow mitigates the risk through specific safeguards.
- Ingestion points: Local repository source code, documentation files (AGENTS.md, CLAUDE.md), and user chat responses.
- Boundary markers: Explicit phase boundaries and the requirement to show evidence (logs, diffs) for all verification tasks.
- Capability inventory: The root agent manages file edits (source, test, docs), while verification tasks (test, build, lint) are delegated to subagents with explicit read-only instructions.
- Sanitization: Relies on mandatory human review of unstaged changes and live UI verification prior to any commit operations.
- [COMMAND_EXECUTION]: The skill instructs the agent to run standard development commands (test, build, lint, etc.) through subagents. This is documented as expected behavior within the RDD workflow and is subject to user oversight.
Audit Metadata