sdlc-sync

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses curl to interact with the backend platform's REST API, including sending JSON payloads stored in temporary files to avoid shell escaping issues. It also references the execution of local maintenance scripts like scripts/dev.sh and helper scripts such as resolve_anchors.py which are expected to be part of the user's local project environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves external data from the platform through pull-artifacts and pull-answers commands, which is then incorporated into local project files and the final synthesized document.\n
  • Ingestion points: Data is ingested from the /api/requirements/<reqId> and /api/requirements/<reqId>/answers endpoints as documented in SKILL.md.\n
  • Boundary markers: The standard-doc-spec.md defines a structured synthesis process that utilizes specific markers such as ✅(Pxx) for confirmed conclusions and ⚠️ for遺留假設 (residual assumptions) to clearly differentiate between sources of information.\n
  • Capability inventory: The skill can perform network operations via curl and read/write markdown files within the sdlc/<需求名>/ directory.\n
  • Sanitization: Content integration follows a rigorous "Standard Requirement Document Synthesis Specification," which limits the synthesis process to merging existing content without allowing the AI to invent new requirements or deviate from the platform's authoritative records.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes lark-cli as an external dependency to fetch requirement snapshots from Feishu (Lark). This is a documented functional requirement for synchronizing external documents with the SDLC platform.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 07:30 AM