spec-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided specification files and incorporates their full content directly into the instruction prompts of subagents. This creates a surface where malicious instructions embedded in a spec file could override the subagents' intended behavior.
- Ingestion points: The skill reads a user-provided spec file (identified in SKILL.md, Workflow step 1) and passes it to subagents.
- Boundary markers: Absent. The instructions in SKILL.md explicitly state to provide the full spec content 'inline in the prompt' without requiring delimiters or instructions for the subagent to ignore embedded commands.
- Capability inventory: The subagents are configured with
subagent_type: "Explore"and are instructed to 'Search the codebase thoroughly,' providing them with read access to the project's source code and configuration files. - Sanitization: No sanitization, escaping, or validation of the input spec file content is performed before it is interpolated into the subagent prompts.
Audit Metadata