inspector-review-update
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from user-provided specification files, which can potentially contain malicious instructions intended to subvert the agent's analysis or patching logic.\n
- Ingestion points: The skill reads proposal.md, design.md, tasks.md, and various delta spec files located within the openspec/changes/ directory, which are then inlined into subagent prompts.\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when inlining these files into the prompts for the specialist subagents.\n
- Capability inventory: The skill possesses the ability to read files, write and edit files (limited to the change directory), and invoke specialist subagents to perform tasks.\n
- Sanitization: There is no evidence of content sanitization or validation performed on the ingested specification data before it is passed to the subagents for processing.
Audit Metadata