workflow-code-to-spec
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the repository (source code, git history, and existing documentation) to generate specifications and update project files. \n
- Ingestion points: The
$scout,$workflow-review-changes, and mode detection steps ingest external codebase and git history data into the agent's context. \n - Boundary markers: While the skill uses structured workflow steps, it lacks explicit delimiters or instructions to ignore potential instructions embedded in the processed source data. \n
- Capability inventory: The skill possesses significant capabilities, including spawning sub-agents (
spawn_agent), writing files to the local filesystem ($docs-update,$spec), and updating task tracking. \n - Sanitization: There is no evidence of specific sanitization, escaping, or filtering of the ingested source code content before it is processed. \n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute several local shell commands and scripts, including
git diff,git log, andnpm run codex:sync. These are standard tools for a development-focused skill but involve direct interaction with the host environment's execution layer.
Audit Metadata