lld-reviewer

Pass

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses python3 to run internal scripts plugins/testany-eng/scripts/trace_lint.py and trace_build_rtm.py as part of the design validation process in Phase 1. These scripts are documented as part of the vendor's toolset and are essential for the skill's stated purpose of design linting and traceability matrix generation.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. 1. Ingestion points: External design documents including LLD, HLD, PRD, and API Contract files. 2. Boundary markers: Absent; there are no explicit instructions to use delimiters or to disregard natural language instructions contained within the analyzed files. 3. Capability inventory: Subprocess execution of Python scripts. 4. Sanitization: Absent; the skill does not specify escaping or validation of inputs derived from the parsed documentation before they are used in the review process or as script arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 5, 2026, 08:28 PM
Security Audit — agent-trust-hub — lld-reviewer