ai-to-spec
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository files and conversation history to synthesize project specifications.
- Ingestion points: The process involves exploring the repository and reading conversation context (SKILL.md).
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat codebase content as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill enables the agent to publish synthesized content to an external issue tracker and apply labels.
- Sanitization: There is no evidence of filtering, escaping, or sanitizing the input data before it is included in the final specification and published.
- [DATA_EXFILTRATION]: The skill's primary function is to extract information from the local development environment (codebase and private chat) and publish it to an external issue tracker. While this is the intended behavior, it creates a risk that sensitive architectural details, credentials accidentally left in code, or private discussion points could be exfiltrated to a potentially public or shared tracker.
Audit Metadata