create-technical-spike
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of markdown documents using variable placeholders such as
${input:FolderPath}and${input:SpikeTitle}. This creates an ingestion surface where external or user-provided data could influence where files are written and what content is included. - Ingestion points: Template variables within
SKILL.mdused for document generation and file path construction. - Boundary markers: None. There are no instructions provided to the agent to treat input variable content as potentially untrusted or to ignore embedded commands.
- Capability inventory: The instructions recommend using
editFilesto write documents, andrunTasksto execute prototypes, creating a link between ingested data and file system/execution capabilities. - Sanitization: No logic is present to sanitize input variables for path traversal sequences or malicious markdown injections.
Audit Metadata