orch-build-mvp
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external design documents that drive the automated code generation process. 1. Ingestion points: Specification documents (e.g., SDD, PRD) provided as file path arguments. 2. Boundary markers: No explicit delimiters or instructions are provided to the agent to differentiate between the document's data and its own instructions. 3. Capability inventory: The skill triggers code scaffolding, TDD implementation, and version control commits through tools like orch-pipeline and gan-build. 4. Sanitization: There is no documented process for sanitizing or validating the contents of the design documents. Manual gates (Gate 1 and Gate 2) are utilized to review the plan and the resulting code before finalization.
Audit Metadata