pdca
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface through its automated analysis and iteration workflows.\n
- Ingestion points: The 'Analyze' (Check) phase reads implementation code from the
src/directory and design documents fromdocs/to compare them.\n - Boundary markers: There are no explicit delimiters or instructions to treat ingested code as untrusted data or to ignore embedded instructions within that code.\n
- Capability inventory: Across its phases, the skill calls MCP tools (
bkit_pdca_analyze,bkit_pdca_plan) and possesses the capability to write todocs/and modify code files insrc/(during the 'Iterate' phase).\n - Sanitization: The skill does not perform sanitization, escaping, or validation of the source code content it ingests before using it to generate analysis reports or code modifications.
Audit Metadata