review
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from plans, diffs, and PR content as its primary input source for analysis.
- Ingestion points: The agent identifies and reads artifacts such as plan paths or diff ranges provided by the user in SKILL.md.
- Boundary markers: There are no explicit delimiters defined for the ingested data; however, the instruction set includes strict guidelines for citation and report structure to maintain focus.
- Capability inventory: The skill's actions are limited to generating markdown reports and proposing content for Architectural Decision Records (ADRs) in the local docs/adr/ directory. It lacks network access, privilege escalation tools, or the ability to perform automated git operations like committing or pushing.
- Sanitization: No explicit sanitization or escaping mechanisms are described for the input data, though the 'Capture test' and rules against 'manufacturing findings' serve as logical filters.
- [SAFE]: The skill defines a constrained workflow for documentation and review with clear prohibitions against dangerous autonomous behaviors.
Audit Metadata