spec-cleanup
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it evaluates untrusted content from specification files to determine whether to recommend their deletion or consolidation.\n
- Ingestion points: The skill reads the primary documents (e.g.,
requirements.md,smolspec.md),decision_log.md, andtasks.mdfrom subdirectories within thespecs/directory.\n - Boundary markers: The instructions do not define boundary markers or explicit safety instructions to prevent the agent from following directives that might be embedded within these analyzed files.\n
- Capability inventory: The skill has the capability to delete directories (
git rm -r) and modify files to consolidate content, which could be abused if an injection is successful.\n - Sanitization: There is no specified sanitization of the file content before it is processed by the agent, nor validation of the directory names extracted from the file system.\n- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the project's version control system for auditing and cleaning up files.\n
- Evidence: It executes
git logwith specific formatting and filters (--diff-filter=A) to retrieve creation and modification dates for spec directories.\n - Evidence: It uses
git rm -rto delete approved directories and falls back tormfor untracked content, which are standard but destructive operations.
Audit Metadata