lld-reviewer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local Python scripts to perform technical validations. Specifically, it executes
python3 plugins/testany-eng/scripts/trace_lint.pyandtrace_build_rtm.pyto verify traceability metadata and construct Requirements Traceability Matrices. These scripts are part of the vendor's specialized engineering plugin environment. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an analysis surface for untrusted data by reading external project documentation including LLD, PRD, HLD, and API Contract files.
- Ingestion points: Phase 0, steps 0.1 and 0.2, involve reading the content of user-provided design and requirement documents.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing the content of these external documents.
- Capability inventory: The agent has access to shell execution (
python3) and interactive user tools (AskUserQuestion,TodoWrite). - Sanitization: There are no defined sanitization or content-filtering steps for the ingested data.
- [DYNAMIC_EXECUTION]: The skill performs runtime execution of logic by passing dynamic file paths into the shell command for the
trace_lint.pyscript. This is the intended mechanism for the agent to validate specific files provided by the user within the development environment.
Audit Metadata