remove-technical-debt
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to offer the installation of additional tools via
npx skills add wondelai/skills/<slug> --global. These resources belong to the same vendor (wondelai) and are utilized for different refactoring phases. - [INDIRECT_PROMPT_INJECTION]: The skill reads project-specific documentation files like
docs/REMOVE-TECHNICAL-DEBT-PLAN.mdto resume work across sessions, which constitutes an indirect prompt injection vulnerability surface. Ingestion points: Files in thedocs/folder such as the tracker,TESTING.md, andTECH-DEBT.md. Boundary markers: None identified in the skill instructions. Capability inventory: File writing/extending, CLI tool suggestions, and dynamic invocation of constituent skills. Sanitization: The skill lacks logic to validate or escape the content read from the documentation artifacts. - [DYNAMIC_EXECUTION]: The skill dynamically invokes other specialized skills based on the current phase, using slugs and instructions provided in the SKILL.md phases.
Audit Metadata