project-context

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase, API specifications, and external issue trackers to generate narrative documentation.\n
  • Ingestion points: Project source code (controllers, services, middleware), OpenAPI specifications, database schema definitions (via tools), and external Jira issue metadata.\n
  • Boundary markers: The skill does not explicitly instruct the model to treat external data as untrusted text, although it uses a structured output format and a mandatory 'Discovery Gaps' section to identify unverified information.\n
  • Capability inventory: File system write access (restricted by user approval), database schema inspection (read-only), issue tracker interaction (search and create), and local shell command execution (git log).\n
  • Sanitization: No specific sanitization or escaping of external content is mentioned before it is interpolated into the generated markdown files.\n- [COMMAND_EXECUTION]: The skill invokes git commands to extract project history and identify recently changed modules.\n
  • Evidence: Invokes git log --oneline with varying depth in references/test-plan.md and references/features.md. These are standard development operations but represent a direct shell execution surface.\n- [PROMPT_INJECTION]: The skill forwards user-provided arguments directly to internal routing logic and tool targets.\n
  • Evidence: SKILL.md specifies 'Forward $ARGUMENTS unchanged to the selected mode'. This provides a potential vector for user-controlled strings to influence downstream tool calls or file operations if not properly sanitized by the underlying agent platform.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 08:14 PM
Security Audit — agent-trust-hub — project-context