spec-test
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from project files to determine execution logic.
- Ingestion points: The skill reads completion criteria and configuration from
tasks.md,design.md,package.json,CLAUDE.md, andcoding-rules.md(Step 1 and Step 2). - Boundary markers: There are no instructions to the agent to treat content in these files as data only or to ignore embedded instructions.
- Capability inventory: The skill can execute shell commands (test runners), write new test files to the filesystem, and commit changes via Git.
- Sanitization: No sanitization or validation of the commands extracted from configuration files is performed before execution.
- [COMMAND_EXECUTION]: The skill dynamically detects and executes shell commands based on the project environment.
- Evidence: Step 5 and Step 2 describe detecting test commands from
package.json,Makefile, andCLAUDE.mdand executing them (e.g.,npm test,pytest). While intended for legitimate testing, this mechanism executes commands defined in the project's own files, which could be modified by a malicious actor in a PR or repository.
Audit Metadata