plan
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its ingestion of untrusted data from external sources combined with high-privilege capabilities.
- Ingestion points: The skill accepts user-provided arguments via the $ARGUMENTS variable and reads local brainstorming documents from the docs/brainstorm/ directory within the codebase.
- Boundary markers: The instructions do not specify the use of delimiters, XML tags, or clear boundary markers to isolate ingested content, nor does it instruct the agent to ignore potentially malicious instructions embedded within those files.
- Capability inventory: The skill is capable of writing new markdown files to the docs/plan/ directory, creating new git branches via the /create-branch tool, and initiating the building process via the /build tool.
- Sanitization: There is no evidence of input validation, sanitization, or safety filtering applied to the data retrieved from the codebase or the user before it is used to influence agent decisions or file content.
Audit Metadata