parallel-integrate
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various system commands to perform git operations (
git merge,git checkout), run build tools (npm run build,go build,npx tsc), and initiate testing frameworks (pytest,go test). While these are standard developer workflows, they execute scripts and binaries defined within the local repository. - [PROMPT_INJECTION]: The skill processes untrusted data from the local file system which constitutes an indirect prompt injection surface. Specifically, it reads
manifest.json, API schemas, and technical specifications to generate reports and verify code compliance. - Ingestion points: Reads content from
manifest.json,api-schema.yaml, and various Tech Spec files located in theparallel/directory. - Boundary markers: The instructions do not define clear delimiters or "ignore" instructions for the agent when processing the content of these external files.
- Capability inventory: The skill has the ability to merge git branches, execute arbitrary project scripts via
npm/python/go, and write to files (integration-report.md). - Sanitization: There is no explicit sanitization or validation step for the content extracted from the JSON and YAML configuration files before it is used to influence the integration logic or report generation.
Audit Metadata