conductor-implement

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard shell commands for version control and testing. Specifically, it uses git add and git commit to track progress, and invokes test runners like npm test or pytest to verify implementation steps. These operations are restricted to the local environment and the project's own codebase.
  • [DATA_EXPOSURE]: The skill reads and modifies project-specific metadata and documentation within the conductor/ directory (e.g., plan.md, metadata.json). These actions are necessary for its task-tracking functionality and do not involve sensitive system files or external data transmission.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project files such as requirements (spec.md) and implementation plans (plan.md). While these files are external to the skill's instructions, the risk of indirect injection is mitigated by the skill's structured state machine and the requirement for manual user approval at each phase completion.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 03:02 AM
Security Audit — agent-trust-hub — conductor-implement