to-spec
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the codebase and conversation context to generate specifications. This creates a surface where malicious instructions embedded in repo files could influence the agent's final output published to the issue tracker.
- Ingestion points: The skill reads "conversation context and codebase understanding" as defined in
SKILL.md. - Boundary markers: No explicit delimiters or warnings are used to separate ingested codebase data from the agent's core instructions.
- Capability inventory: The skill explores the repository (file system read) and publishes data to a "project issue tracker" (network write).
- Sanitization: The skill lacks explicit sanitization or validation logic for the ingested repository content before it is interpolated into the specification template.
Audit Metadata