full-deploy
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user input via the $ARGUMENTS variable without sanitization or boundary markers.
- Ingestion points: The $ARGUMENTS variable in SKILL.md is used to pass application names and deployment requirements directly into the pipeline logic.
- Boundary markers: No delimiters or instructions are used to separate user input from the agent's core instructions.
- Capability inventory: The skill performs extensive file system operations, Docker builds, and GitHub Actions workflow creation across four sequential phases.
- Sanitization: No validation or escaping of the input arguments is performed before they are processed by the referenced sub-skills.
- [DATA_EXFILTRATION]: The SELF-EVOLUTION TELEMETRY section accesses a hidden directory at ~/.claude/projects/ to log execution metadata.
- Accessing hidden application data directories (starting with a dot) is a potential risk as it may expose internal platform state, session metadata, or project-specific context that should not be directly manipulated by user-authored skills.
Audit Metadata