feature-dev
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands git and gh (GitHub CLI) to manage the local repository and interact with remote hosting.
- git add, git commit, git checkout, and git push are used for standard version control operations.
- gh pr create is used to generate pull requests using the GitHub CLI.
- [DATA_EXFILTRATION]: The skill transmits code changes and descriptive metadata to GitHub via git push and gh pr create. This is the intended primary function for collaborative development and targets a well-known technology service (GitHub).
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it ingests untrusted data from the codebase and user-provided descriptions.
- Ingestion points: Feature requirements from user input ($ARGUMENTS), codebase files read by explorers, and findings from various sub-agents.
- Boundary markers: The workflow uses specific blackboard keys and structured task descriptions to separate context, although it does not use explicit 'ignore embedded instructions' delimiters for file content.
- Capability inventory: The skill can modify the local filesystem via sub-agents, perform git commits, push code, and create pull requests.
- Sanitization: The skill uses cat <<'EOF' heredocs in shell commands to safely handle multiline strings, which prevents command injection during commit and PR creation steps.
- Mitigation: The orchestration design includes five mandatory interactive approval gates (Phase 1, 3, 4, 5, and 6) where the human user must review and approve feature specifications, architecture designs, implementation plans, and review findings before code is finalized or pushed.
Audit Metadata