z-design-brief
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
fdcommand-line utility in theVerifysection to confirm that the generated design brief markdown file exists in thedocs/design/directory. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests user input during the screen inventory interview and writes it to a documentation file. However, the data is written to a static markdown file in a specific project directory and is not passed to executable contexts or remote endpoints.
- [SAFE]: No evidence of credential harvesting, unauthorized network communication, or code obfuscation was found. The skill's behavior aligns exactly with its stated purpose of facilitating design documentation.
Audit Metadata