understand-project-yylo
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process a variety of external project artifacts, which could contain malicious instructions meant to subvert the agent's behavior.
- Ingestion points: The skill reads
AGENTS.md,CLAUDE.md, repository status, source code, tests, project documentation, Kanban tasks, and durable specs (SKILL.md, steps 1-2). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this external data as untrusted or to ignore embedded instructions.
- Capability inventory: The skill possesses the ability to execute shell commands via the
yyCLI tool and write files for durable specs (SKILL.md, steps 5-6). - Sanitization: No sanitization or validation processes are mentioned for the ingested data before it is processed or used to construct commands.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
yyCLI tool (e.g.,yy task start TASK_ID). While this appears to be a legitimate vendor-provided tool for task management, theTASK_IDis derived from external Kanban metadata, which could potentially be manipulated if not properly handled by the agent's shell interface.
Audit Metadata