sdd-tasks
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest untrusted project data (proposals, specs, and designs) which creates a surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: The skill reads content from
sdd/{change-name}/proposal,sdd/{change-name}/spec, andsdd/{change-name}/designin SKILL.md. - Boundary markers: The instructions do not define clear delimiters or provide the agent with "ignore embedded instructions" warnings for the content read from these files.
- Capability inventory: The skill has the capability to write files to the local filesystem (
openspec/changes/{change-name}/tasks.md). - Sanitization: There is no instruction to sanitize, validate, or escape the content ingested from the design documents before processing it.
Audit Metadata