plan
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill uses the
$ARGUMENTSvariable to construct file paths for reading (.specs/specs/<slug>.md) and writing (.specs/plans/<slug>.md). The lack of explicit sanitization for the<slug>variable creates a potential path traversal vulnerability, which could allow the agent to read or write files outside the intended directories if the platform does not enforce strict path boundaries. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted data from external specification files to drive agent behavior and plan generation.
- Ingestion points: The agent reads external content from files located at
.specs/specs/<slug>.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" markers are defined to help the agent distinguish between the specification data and its own system instructions.
- Capability inventory: The agent possesses the capability to read project files, explore the codebase architecture, and write new implementation plans to the filesystem.
- Sanitization: There is no mention of sanitizing, escaping, or validating the content of the specification files before it is interpolated into the planning workflow.
Audit Metadata