scan-all
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell command using
node -eto call logic within the project's own.claudedirectory. This is used for internal maintenance of status flags. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes external data from various project documentation files.
- Ingestion points: Reads and summarizes output from files in the
docs/project-reference/directory (SKILL.md). - Boundary markers: Does not utilize explicit boundary markers or 'ignore' instructions when processing documentation content.
- Capability inventory: Includes shell command execution capabilities via Node.js (SKILL.md).
- Sanitization: No visible sanitization or filtering of the content read from reference documents before processing.
Audit Metadata