lld-reviewer

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local Python scripts to perform technical validations. Specifically, it executes python3 plugins/testany-eng/scripts/trace_lint.py and trace_build_rtm.py to verify traceability metadata and construct Requirements Traceability Matrices. These scripts are part of the vendor's specialized engineering plugin environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill acts as an analysis surface for untrusted data by reading external project documentation including LLD, PRD, HLD, and API Contract files.
  • Ingestion points: Phase 0, steps 0.1 and 0.2, involve reading the content of user-provided design and requirement documents.
  • Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the content of these external documents.
  • Capability inventory: The agent has access to shell execution (python3) and interactive user tools (AskUserQuestion, TodoWrite).
  • Sanitization: There are no defined sanitization or content-filtering steps for the ingested data.
  • [DYNAMIC_EXECUTION]: The skill performs runtime execution of logic by passing dynamic file paths into the shell command for the trace_lint.py script. This is the intended mechanism for the agent to validate specific files provided by the user within the development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 06:30 AM