req-change-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to read and analyze project source code (e.g.,
service_worker.js,manifest.json) to establish a behavior baseline. This ingestion of untrusted data from the local environment creates a potential attack surface where instructions embedded in code comments could mislead the agent. - Ingestion points: Source files identified in
SKILL.md(Step 2) such as entrypoints, background scripts, and core modules. - Boundary markers: The workflow includes a human-in-the-loop approval gate (Step 4), but lacks technical delimiters or specific instructions to ignore embedded commands within the analyzed code.
- Capability inventory: The agent can search the filesystem using
rg, read file contents, and perform file-write operations in the implementation phase (Step 5). - Sanitization: There is no mention of sanitizing or filtering code comments or metadata during the analysis phase.
- [COMMAND_EXECUTION]: The skill utilizes a local shell script (
scripts/impact_scan.sh) to perform filesystem searches. While the script is well-structured and uses safe argument handling, it represents the execution of a subprocess. - Evidence: The
scripts/impact_scan.shscript executes therg(ripgrep) utility to scan the project directory for user-provided keywords.
Audit Metadata