business-requirements-interview
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
sherpycommand-line utility to perform strict validation of the generated requirements document at the end of the interview process. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes and stores untrusted user data.
- Ingestion points: Project descriptions provided by the user and subsequent interview answers, as well as the
business-interview.jsonlfile when resuming a session. - Boundary markers: None present; the skill lacks specific delimiters or instructions to ignore commands embedded within user-supplied project details.
- Capability inventory: The skill writes to the file system (artifacts and requirements directories) and executes local commands via the
sherpyvalidator. - Sanitization: No sanitization or validation of the content of user answers is performed before they are interpolated into the final YAML output or the session log.
Audit Metadata