feature
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user-provided natural language ("功能描述" or "feature description") and interpolates this content into project documentation files and delegation prompts for sub-agents.
- Ingestion points: Untrusted data enters the agent context through the
/featurecommand input which is then used to drive the orchestration of requirements, design, and task generation. - Boundary markers: The skill lacks explicit boundary markers or sanitization instructions to delimit user-provided descriptions before they are written to Markdown files or passed to specialized tools like
/requirementsor/system-design. - Capability inventory: The skill possesses significant capabilities that could be targeted by a successful injection, including file system access (Read, Write, Edit), shell command execution (Bash), and the ability to trigger and influence other AI agent skills (Task).
- Sanitization: There is no evidence of input validation, escaping, or filtering applied to the user-provided feature descriptions before they are used to update documentation or system tasks.
Audit Metadata