write-spec
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several command-line tools to interact with the repository and external services:
git,fd, andrgare used to find existing feature files and architecture records to ensure the generated spec matches local styles.gh pr viewis used to fetch Pull Request descriptions from GitHub for feature context.npx cucumber-js --dry-runis used to validate the syntax of the generated Gherkin file.- These actions are appropriate for the skill's functionality and use standard developer tools.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) because it reads and processes external, potentially untrusted data:
- Ingestion points: The skill reads external content from GitHub PR bodies (
gh pr view) and local repository files (ADRs and existing specs) to inform the generation of the new feature file. - Boundary markers: No specific delimiters or "ignore instructions" directives are used when interpolating this external content into the agent's context.
- Capability inventory: The agent has permissions to write to the filesystem, commit to the repository via
git, and execute shell commands. - Sanitization: There is no evidence of sanitization or filtering of the content retrieved from PRs or local files before it is processed by the AI.
Audit Metadata