z-design-brief

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the fd command-line utility in the Verify section to confirm that the generated design brief markdown file exists in the docs/design/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests user input during the screen inventory interview and writes it to a documentation file. However, the data is written to a static markdown file in a specific project directory and is not passed to executable contexts or remote endpoints.
  • [SAFE]: No evidence of credential harvesting, unauthorized network communication, or code obfuscation was found. The skill's behavior aligns exactly with its stated purpose of facilitating design documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 09:30 AM