exit-criteria

Warn

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill implements an overlay feature that checks the POWERSUIT_OVERLAY environment variable to find additional instructions. It is explicitly directed to prioritize these external files over its own logic, which allows for dynamic modification of the agent's behavior based on the environment configuration.\n- [COMMAND_EXECUTION]: The skill runs bash commands to copy documentation templates and execute a Python script located at .github/actions/gate/run.py. These commands allow the agent to perform file system operations and run arbitrary local code.\n- [DATA_EXFILTRATION]: The agent is instructed to create a list of highly sensitive administrative systems, specifically naming cloud accounts, billing information, and CI secrets. While this is used to track access migration, it exposes the location and nature of high-value credentials and infrastructure metadata.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from multiple repository files and command outputs to verify exit criteria. It lacks boundary markers or sanitization to prevent malicious data in these sources from influencing the agent's logic.\n
  • Ingestion points: docs/handover.md, docs/decisions/index.md, the incidents directory, gate/latest.json, and the output of git log commands.\n
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the processing steps.\n
  • Capability inventory: File system writes (mkdir, cp), Python script execution (python3), and repository metadata inspection (git log).\n
  • Sanitization: The skill does not describe any validation or escaping of external content before it is interpolated into the decision-making process.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 11, 2026, 12:50 PM