sdlc-sync
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the backend platform's REST API, including sending JSON payloads stored in temporary files to avoid shell escaping issues. It also references the execution of local maintenance scripts likescripts/dev.shand helper scripts such asresolve_anchors.pywhich are expected to be part of the user's local project environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves external data from the platform throughpull-artifactsandpull-answerscommands, which is then incorporated into local project files and the final synthesized document.\n - Ingestion points: Data is ingested from the
/api/requirements/<reqId>and/api/requirements/<reqId>/answersendpoints as documented inSKILL.md.\n - Boundary markers: The
standard-doc-spec.mddefines a structured synthesis process that utilizes specific markers such as✅(Pxx)for confirmed conclusions and⚠️for遺留假設 (residual assumptions) to clearly differentiate between sources of information.\n - Capability inventory: The skill can perform network operations via
curland read/write markdown files within thesdlc/<需求名>/directory.\n - Sanitization: Content integration follows a rigorous "Standard Requirement Document Synthesis Specification," which limits the synthesis process to merging existing content without allowing the AI to invent new requirements or deviate from the platform's authoritative records.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes
lark-clias an external dependency to fetch requirement snapshots from Feishu (Lark). This is a documented functional requirement for synchronizing external documents with the SDLC platform.
Audit Metadata