implement-spec-in-workflow

Warn

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates a JavaScript orchestration script (workflow.js) at runtime by substituting placeholders into a provided template (workflow.template.js). This rendered script is then executed via the crew or orca session runners to manage the multi-agent implementation process.
  • [PERSISTENCE]: The skill employs a session runner (crew) that operates as a background daemon, intended to allow implementation tasks to outlive the initial agent session and survive potential daemon restarts or system reboots.
  • [INDIRECT_PROMPT_INJECTION]: The workflow ingests untrusted data from GitHub issue titles, specification bodies, and ticket criteria. This external content is interpolated into prompts for sub-agents which possess significant capabilities including file system access and command execution.
  • Ingestion points: Data enters the system via gh issue view calls in SKILL.md (Step 2) and within several phases of the workflow.template.js (Graph, Implement, and Gate phases).
  • Boundary markers: While the skill provides CONTRACT and ECONOMY instructions to guide agent behavior, it lacks explicit escaping, sanitization, or "ignore instructions" delimiters when interpolating the raw issue content into sub-agent prompts.
  • Capability inventory: Sub-agents have the authority to execute git (rebase, push, switch), gh (PR creation, stack registration), npm, and node commands, as well as perform file writes to the local filesystem.
  • Sanitization: No validation or sanitization of the ingested GitHub issue text is performed before it is used to influence sub-agent logic.
  • [COMMAND_EXECUTION]: The skill makes extensive use of system commands for environment discovery and repository management, including git, gh, npm, orca, and crew. It also uses node shell execution (-e and -p) for process management and JSON parsing.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @javrasya/crew package globally via NPM and the gh-stack extension via the GitHub CLI. The @javrasya/crew package is a vendor-owned resource associated with the skill author.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 7, 2026, 12:21 PM