understand-project-yylo

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process a variety of external project artifacts, which could contain malicious instructions meant to subvert the agent's behavior.
  • Ingestion points: The skill reads AGENTS.md, CLAUDE.md, repository status, source code, tests, project documentation, Kanban tasks, and durable specs (SKILL.md, steps 1-2).
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat this external data as untrusted or to ignore embedded instructions.
  • Capability inventory: The skill possesses the ability to execute shell commands via the yy CLI tool and write files for durable specs (SKILL.md, steps 5-6).
  • Sanitization: No sanitization or validation processes are mentioned for the ingested data before it is processed or used to construct commands.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the yy CLI tool (e.g., yy task start TASK_ID). While this appears to be a legitimate vendor-provided tool for task management, the TASK_ID is derived from external Kanban metadata, which could potentially be manipulated if not properly handled by the agent's shell interface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 11:12 PM
Security Audit — agent-trust-hub — understand-project-yylo