docs
Pass
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands such as
git diff,git symbolic-ref, andgrepto analyze the repository state and verify documentation links. These commands are used for read-only inspection of the local environment.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external project files to inform its documentation tasks.\n - Ingestion points: The agent reads from
.context/<feature-id>/DECISIONS.md,.context/<feature-id>/PLAN.md, and.ystack/progress/<module>.mdto understand feature requirements and implementation status.\n - Boundary markers: There are no instructions provided to separate the content of these files from the agent's system instructions or to treat them as untrusted data.\n
- Capability inventory: The agent can modify project documentation files, structural configuration files (like
CLAUDE.md), and execute local shell commands.\n - Sanitization: No sanitization or validation logic is defined for the content ingested from the project context files.
Audit Metadata