spec-kit-converge
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted data from various project files to perform its audit. Malicious instructions embedded in the code or specification files could potentially influence the agent's assessment or reporting behavior.
- Ingestion points: The skill reads
spec.md,plan.md,tasks.md,FRAMEWORK.md,FRAMEWORK.local.md, and any source code files modified in a change. - Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore instructions embedded within the audited content.
- Capability inventory: The agent can read any file in the project root, execute
git diff, and append findings totasks.md. - Sanitization: There are no instructions to sanitize, escape, or validate the content of the files before they are processed by the LLM.
Audit Metadata