assess-technical-debt
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs sub-agents to execute project-specific test runners and install dependencies. To mitigate risks, these operations are performed within isolated
git worktreeenvironments created in the system temporary directory ($TMPDIR), with enforced timeouts and process group isolation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of source code, test configurations, and CI workflows. While this presents an attack surface for indirect prompt injection, the skill includes instructions for sub-agents to treat the main working tree as read-only and validates findings through an evaluation pass.
- [COMMAND_EXECUTION]: The skill utilizes several CLI tools for static analysis (such as
git,lizard,radon, andjscpd) and shell commands to manage the analysis workflow. It specifies that agents should use existing tools rather than installing new ones globally, reducing the risk of unauthorized software installation.
Audit Metadata