resolve-follow-ups
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Markdown files located in
docs/follow-ups/to drive the agent's actions. - Ingestion points: Reads task definitions from
docs/follow-ups/*.md, which include fields like 'Symptom', 'Observed evidence', and 'Proposed next step'. - Boundary markers: There are no explicit delimiters or instructions to ignore embedded prompts within the follow-up files.
- Capability inventory: The skill has significant capabilities, including executing Git commands, creating worktrees, and pushing code to remote branches via
scripts/resolve-follow-ups.sh. - Sanitization: The script performs structural validation of the files (checking for headers) but does not sanitize the natural language content.
- [EXTERNAL_DOWNLOADS]: The instructions suggest installing a dependency using
npx skills@latest add toy-crane/skills --skill project-knowledge. This fetches code from the npm registry. - [COMMAND_EXECUTION]: Extensive use of a local shell script,
scripts/resolve-follow-ups.sh, to perform advanced Git operations, process management, and repository state tracking. This includes creating worktrees, updating refs, and managing shadow repositories in temporary directories.
Audit Metadata