sdpm-spec

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from user materials and external URLs which are passed to downstream agents.\n
  • Ingestion points: The specs/brief.md file (Source Material section) and external content fetched via WebFetch.\n
  • Multi-step chain: Phase 1 agents generate specification files that are consumed by Phase 2 composer agents, creating a pipeline where malicious input could influence subsequent autonomous actions.\n
  • Boundary markers: The skill relies on section headers (e.g., 'Source Material') but lacks explicit instructions to agents to ignore potentially conflicting commands embedded in that data.\n
  • Capability inventory: The agents can execute Python code (run_python), generate presentation files (generate_pptx), and read/write workspace files.\n
  • Sanitization: The skill notes that the run_python tool performs lint_and_sanitize when saving files.\n- [COMMAND_EXECUTION]: The skill instructs the agent to generate and execute Python logic via the run_python MCP tool for file manipulation and slide metrics.\n
  • Evidence: Used for reading/writing JSON/text files and calculating layout dimensions (e.g., image resizing logic).\n
  • Mitigation: The skill states the environment is sandboxed with open(), import, and network access disabled by the underlying tool implementation.\n- [EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to retrieve content from external URLs provided by the user.\n
  • Evidence: Gathered during the briefing sub-phase to populate the presentation's source material context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:54 AM
Security Audit — agent-trust-hub — sdpm-spec