mece-plan-review
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: Comprehensive analysis of the 8 skill files found no evidence of malicious intent, credential theft, or hidden behaviors. The skill logic is focused on software engineering quality assurance.
- [COMMAND_EXECUTION]: The skill uses
gitand the GitHub CLI (gh) to resolve the repository organization and fetch a list of related repositories. These commands are executed locally within the user's development environment to provide context for the review analysts. - [EXTERNAL_DOWNLOADS]: The Black Box analyst (
bb-analyst.md) utilizesWebFetchto access technical specifications and documentation from public sources like RFCs or official vendor docs, which is appropriate for its role in specification verification. - [PROMPT_INJECTION]: The skill ingests untrusted content from plan files and analysis documents. The main agent interpolates this data into subagent prompts using descriptive boundary markers (e.g., 'プランファイル:'). The system leverages subagents with file access and search capabilities to perform its review, though it does not implement formal sanitization of the input text.
Audit Metadata