create-technical-spike
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to gather information from external sources, including third-party documentation, APIs, and libraries, to generate technical spike documents. This behavior creates a vulnerability surface where malicious instructions hidden in external content could potentially influence the agent's behavior or the content of the generated files.\n
- Ingestion points: External documentation, API references, and third-party libraries (referenced in SKILL.md under 'Research strategy').\n
- Boundary markers: None identified. The skill lacks instructions to isolate or treat external data as untrusted.\n
- Capability inventory: The skill possesses the capability to write markdown files to the local filesystem (documented in 'File and frontmatter rules').\n
- Sanitization: None identified. There are no requirements for validating or sanitizing external data before it is processed and stored.
Audit Metadata