guardrails-writer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from repository files (ADRs, Runbooks, CI configurations, and incident logs) to extract facts and generate project-level guardrails. This creates an inherent surface for indirect prompt injection where malicious instructions embedded in those documents could potentially influence the agent's governance output.
- Ingestion points: Phase 0 and Phase 1 instructions specify scanning and reading various repository artifacts including Guardrails, ADRs, architecture docs, CI rules, incident reviews, Runbooks, and release specifications.
- Boundary markers: The skill does not explicitly use delimiters for ingested data but relies on a structured evidence matrix and the
references/fact-standard.mdguideline to categorize input. - Capability inventory: The agent has the capability to write and update project documentation files and suggest changes to downstream developer workflows.
- Sanitization: The skill mitigates risks by implementing an evidence-based verification layer that requires cross-referencing facts between multiple sources (code, config, CI, etc.) before they are elevated to a guardrail candidate.
Audit Metadata