quickie
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from various sources including intent files, topic folders, and repository source code to automate design tasks. This interpolation of external content into the reasoning process creates a vulnerability to indirect prompt injection.
- Ingestion points: SKILL.md instructs the agent to read user requests, intent files, topic artifacts, and repository code (contracts, callers, and tests).
- Boundary markers: The instructions do not define specific delimiters or "ignore instructions" markers to isolate the ingested data from the agent's operational logic.
- Capability inventory: The skill generates specifications and plans and invokes other design agents, though it is explicitly restricted from executing git commands or modifying production code, tests, and project configurations.
- Sanitization: There is no mention of sanitizing, escaping, or validating the content of external files before processing.
Audit Metadata