discuss-change
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted information from external sources (WebSearch, documentation tools) to influence implementation logic and design decisions.
- Ingestion points: Web search results, external documentation, and user-provided screenshots are used to confirm external constraints and observe rendered states in Steps 2 and 3.
- Boundary markers: The skill does not define specific delimiters or warnings to isolate untrusted external content from the agent's core instructions.
- Capability inventory: The agent has the ability to modify the codebase via the
/implementskill (Step 6), create tasks (TaskCreate), and manage a backlog (/note-improvement). - Sanitization: There are no explicit instructions to sanitize or validate the content retrieved from external tools before using it to define the implementation shape.
- [COMMAND_EXECUTION]: The instructions direct the agent to run the application from the current code (Step 2 and 3) to observe how surfaces render. While this is a functional requirement for the skill's purpose, it involves executing arbitrary code from the current repository.
Audit Metadata