kuroco-spec-writer
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted configuration data from external Kuroco sites, including API summaries, content field names, and custom function descriptions, which are then interpolated into documents.
- Ingestion points: Site settings collected via tools like topics_group-get, api-list_api, and custom_function-list as described in the workflow.
- Boundary markers: The skill relies on standard formatting (double quotes for labels, backticks for code) but lacks explicit security boundaries for ingested site content.
- Capability inventory: The documentation process leads to a rendering step involving local shell commands and a headless browser.
- Sanitization: The instructions explicitly direct the agent to mask secret keys (tokens, passwords) with '***', though it does not provide full sanitization against Markdown or Mermaid structure injection.
- [DYNAMIC_EXECUTION]: The utility script scripts/build-pdf.mjs dynamically constructs an HTML document containing the collected site data and executes JavaScript for rendering.
- Evidence: The buildHtml function in the script assembles an HTML string that includes a script tag for site data and imports rendering logic from external sources.
- [COMMAND_EXECUTION]: The skill includes a utility script that interacts with the host operating system to produce final deliverables.
- Evidence: scripts/build-pdf.mjs uses spawnSync and execFileSync to locate and run system binaries including Chrome/Chromium and the zip command.
- [EXTERNAL_DOWNLOADS]: The PDF generation process depends on external resources fetched at runtime.
- Evidence: scripts/build-pdf.mjs imports markdown-it and mermaid from cdn.jsdelivr.net within the generated HTML. JSDelivr is recognized as a well-known CDN service.
Audit Metadata