project-context
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase, API specifications, and external issue trackers to generate narrative documentation.\n
- Ingestion points: Project source code (controllers, services, middleware), OpenAPI specifications, database schema definitions (via tools), and external Jira issue metadata.\n
- Boundary markers: The skill does not explicitly instruct the model to treat external data as untrusted text, although it uses a structured output format and a mandatory 'Discovery Gaps' section to identify unverified information.\n
- Capability inventory: File system write access (restricted by user approval), database schema inspection (read-only), issue tracker interaction (search and create), and local shell command execution (git log).\n
- Sanitization: No specific sanitization or escaping of external content is mentioned before it is interpolated into the generated markdown files.\n- [COMMAND_EXECUTION]: The skill invokes git commands to extract project history and identify recently changed modules.\n
- Evidence: Invokes
git log --onelinewith varying depth inreferences/test-plan.mdandreferences/features.md. These are standard development operations but represent a direct shell execution surface.\n- [PROMPT_INJECTION]: The skill forwards user-provided arguments directly to internal routing logic and tool targets.\n - Evidence:
SKILL.mdspecifies 'Forward $ARGUMENTS unchanged to the selected mode'. This provides a potential vector for user-controlled strings to influence downstream tool calls or file operations if not properly sanitized by the underlying agent platform.
Audit Metadata