implement-spec
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to instructions embedded within the external data it is designed to process.
- Ingestion points: The agent reads external specifications, issue tracker tickets, and repository files such as
AGENTS.md(SKILL.md, lines 7, 10, 26). - Boundary markers: No explicit delimiters or safety instructions are provided to the agent to distinguish between the data content and instructions, increasing the risk of the agent obeying malicious commands hidden in the spec or tickets.
- Capability inventory: The skill and its subagents have the authority to write code to the local file system, execute arbitrary shell commands (for tests, formatting, and linting), and perform git operations (SKILL.md, lines 47-51, 62).
- Sanitization: There is no mechanism described for validating or sanitizing the content of the tickets or specifications before they are passed to implementer subagents.
Audit Metadata