ai-to-spec-workplan
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
wpcommand-line interface to list existing workplans and create new ones. It uses structured JSON output (--json) and handles file-based content submission. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from the repository (ADRs, glossary, implementation files) and conversation history to generate specifications.
- Ingestion points: Repository files such as glossary terms, Architecture Decision Records (ADRs), and existing implementation tests (SKILL.md, Step 1).
- Boundary markers: The instructions enforce a strict Markdown schema (Step 4) for the output, requiring the agent to map data into specific sections (Problem statement, Solution, User stories, etc.), which limits the ability of embedded instructions to hijack the agent's control flow.
- Capability inventory: The skill has the ability to execute
wpCLI commands for listing and creating resources, and it can write to and delete temporary files (SKILL.md, Step 5). - Sanitization: The skill mandates synthesizing only "settled" information and strictly following a predefined template, reducing the risk of malicious instructions in the source data influencing the final command execution.
Audit Metadata