design-normalize
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands for project validation in Phase 9, including build scripts (e.g., npm run build), linters, and test suites.
- [PROMPT_INJECTION]: The skill operates with high autonomy ('You do not ask questions', 'Do NOT ask the user questions') while scanning the entire codebase. This creates a surface for indirect prompt injection where malicious instructions embedded in project files (e.g., in code comments or documentation) could be followed by the agent.
- Ingestion points: Reads all files in the codebase (CSS, JS, TS, Dart, Swift, etc.) during Phases 1 and 2 to identify tokens and deviations.
- Boundary markers: No explicit instruction delimiters or 'ignore embedded instructions' directives are present in the prompt templates.
- Capability inventory: Possesses extensive file-write capabilities (Phases 3 through 8) and shell execution capabilities (Phase 9).
- Sanitization: No sanitization or validation of the content read from files is specified before the content influences the agent's state or modification logic.
Audit Metadata