sdpm-spec
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from user materials and external URLs which are passed to downstream agents.\n
- Ingestion points: The
specs/brief.mdfile (Source Material section) and external content fetched viaWebFetch.\n - Multi-step chain: Phase 1 agents generate specification files that are consumed by Phase 2 composer agents, creating a pipeline where malicious input could influence subsequent autonomous actions.\n
- Boundary markers: The skill relies on section headers (e.g., 'Source Material') but lacks explicit instructions to agents to ignore potentially conflicting commands embedded in that data.\n
- Capability inventory: The agents can execute Python code (
run_python), generate presentation files (generate_pptx), and read/write workspace files.\n - Sanitization: The skill notes that the
run_pythontool performslint_and_sanitizewhen saving files.\n- [COMMAND_EXECUTION]: The skill instructs the agent to generate and execute Python logic via therun_pythonMCP tool for file manipulation and slide metrics.\n - Evidence: Used for reading/writing JSON/text files and calculating layout dimensions (e.g., image resizing logic).\n
- Mitigation: The skill states the environment is sandboxed with
open(),import, and network access disabled by the underlying tool implementation.\n- [EXTERNAL_DOWNLOADS]: The skill uses theWebFetchtool to retrieve content from external URLs provided by the user.\n - Evidence: Gathered during the briefing sub-phase to populate the presentation's source material context.
Audit Metadata