ziw-implement
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from issue trackers, comments, and external documentation which could contain instructions designed to manipulate agent behavior.
- Ingestion points: Tracker issue bodies, comments, labels, attachments, and referenced external documentation as described in the Context and Claim sections of SKILL.md.
- Boundary markers: The skill includes a dedicated "Instruction Trust" section that explicitly directs the agent to treat these inputs as untrusted work context and prohibits following instructions that override core security or operational policies.
- Capability inventory: The agent is authorized to modify the local filesystem, create git branches and worktrees, and execute tools such as ziw-pr, ziw-code-review, and repository-specific commands like pnpm format:docs:check.
- Sanitization: The skill relies on natural language instructions for the agent to disregard malicious prompts within the ingested data; no automated sanitization or schema validation is specified for the external inputs.
Audit Metadata