workflow-spec-to-pbi
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data from repository documentation to generate artifacts.
- Ingestion points: The skill reads feature specs from
docs/specs/{Bucket}/README.{Feature}.mdand bucket catalogs fromdocs/specs/{Bucket}/INDEX.md(Protocol Step 2). - Boundary markers: While the protocol includes refinement and review steps (Step 7), it does not define specific delimiters or instructions to ignore embedded prompts within the source specifications.
- Capability inventory: The skill is authorized to use
spawn_agentfor sub-tasks and has extensive file-writing capabilities toteam-artifacts/,plans/reports/, anddocs/specs/(Protocol Steps 7, 8.5). - Sanitization: There is no evidence of content sanitization or validation of the input markdown files before they are processed by the agent or its sub-agents.
Audit Metadata