to-spec
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inputs from conversation history and the repository codebase to generate specifications. This creates a surface for indirect prompt injection where malicious content within those sources could influence the agent's actions, such as the content published to the issue tracker.
- Ingestion points: Instructions in SKILL.md direct the agent to synthesize data from the current conversation context and the codebase.
- Boundary markers: The instructions lack explicit delimiters or "ignore" directives for instructions embedded within the conversation or files.
- Capability inventory: The agent is authorized to explore the repository and publish synthesized content to an external issue tracker.
- Sanitization: There are no documented steps for sanitizing or validating the ingested content before it is used in the specification or published.
Audit Metadata