parallel-integrate

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various system commands to perform git operations (git merge, git checkout), run build tools (npm run build, go build, npx tsc), and initiate testing frameworks (pytest, go test). While these are standard developer workflows, they execute scripts and binaries defined within the local repository.
  • [PROMPT_INJECTION]: The skill processes untrusted data from the local file system which constitutes an indirect prompt injection surface. Specifically, it reads manifest.json, API schemas, and technical specifications to generate reports and verify code compliance.
  • Ingestion points: Reads content from manifest.json, api-schema.yaml, and various Tech Spec files located in the parallel/ directory.
  • Boundary markers: The instructions do not define clear delimiters or "ignore" instructions for the agent when processing the content of these external files.
  • Capability inventory: The skill has the ability to merge git branches, execute arbitrary project scripts via npm/python/go, and write to files (integration-report.md).
  • Sanitization: There is no explicit sanitization or validation step for the content extracted from the JSON and YAML configuration files before it is used to influence the integration logic or report generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 06:49 AM