project-discover
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill is designed to analyze project code and generate documentation within the
.aidlc/project/directory. It does not attempt to access sensitive system files (e.g., SSH keys, AWS credentials) or hardcode secrets. - [REMOTE_CODE_EXECUTION]: No remote script downloads (e.g.,
curl | bash) or unverifiable package installations are present. The skill references internal sub-skills and a parallel dispatching mechanism for workflow orchestration, but does not invoke external, untrusted code. - [COMMAND_EXECUTION]: The instructions focus on documentation generation and file system writes restricted to the project's documentation folder. There are no patterns for executing arbitrary shell commands or privilege escalation.
- [PROMPT_INJECTION]: The skill uses natural instructional language to define its workflow. It does not contain any attempts to bypass safety filters, override system prompts, or extract internal instructions.
- [OBFUSCATION]: No obfuscated content, encoded strings (Base64/Hex), or hidden characters were detected in the instructions.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests untrusted code data, it includes strict rules against hallucination and requires 'Evidence Gaps' for missing information, which serves as a defensive boundary against data-driven misbehavior during the documentation process.
Audit Metadata