levelup-clarify
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local setup scripts (scripts/bash/setup-levelup-clarify.sh or scripts/powershell/setup-levelup-clarify.ps1) to initialize the review environment. These scripts perform safe directory discovery and file counting within the project root.
- [INDIRECT_PROMPT_INJECTION]: The skill reads and processes the content of CDR draft files (.adlc/drafts/cdr/CDR-*.md). If these files are sourced from untrusted external contributions, they could contain malicious instructions. However, the skill acts as a human-in-the-loop review tool, which mitigates the risk of automatic execution of such content.
- [DYNAMIC_EXECUTION]: The 'Enforceability Gate' (Phase 2b/4) allows the skill to generate and implement deterministic checks such as unit tests, linters, or pre-commit hooks. While this involves code generation, it is done under explicit user approval and is restricted to the development environment's testing infrastructure.
Audit Metadata