requirement-to-spec
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external files (Word, PDF, Excel, Markdown) and their attachments, presenting an attack surface for indirect prompt injection. \n
- Ingestion points: The path to the requirement document is passed via $ARGUMENTS in SKILL.md, and the agent performs a Glob for attachments as described in references/document-conversion.md. \n
- Boundary markers: The skill includes explicit instructions in SKILL.md and references/document-conversion.md to treat input as data and ignore embedded directives (e.g., "ignore previous instructions"). \n
- Capability inventory: The skill has access to Write (scoped to docs/specs/**), Agent, and Bash for conversion and CLI tasks, as well as Linear and Azure DevOps MCP tools. \n
- Sanitization: Instructions mandate that the agent quote and flag directives instead of following them. \n- [EXTERNAL_DOWNLOADS]: The skill uses npx to fetch the @firecrawl/anydoc utility for document conversion. \n
- Evidence: npx -y @firecrawl/anydoc@0.2.3 is permitted in the allowed-tools frontmatter and references/document-conversion.md. \n
- Purpose: The utility is essential for converting various document formats to Markdown as per the skill's primary function. \n- [COMMAND_EXECUTION]: The skill executes shell commands using Bash to interact with Node.js and the Azure DevOps CLI. \n
- Evidence: SKILL.md allowed-tools lists specific command patterns for npx and az CLI tools. \n
- Constraints: Commands are restricted to specific utilities and flag patterns (e.g., az devops invoke --area wit) to minimize the scope of execution.
Audit Metadata