sus-spec
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes content from external sources (like issue trackers) that may contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The skill reads project rules, current code, durable decisions, related artifacts, and open issues during the context-gathering phase (SKILL.md).
- Boundary markers: There are no explicit instructions to use delimiters or to disregard instructions found within the ingested data.
- Capability inventory: The skill allows the agent to read project files, write artifacts to
~/.agents/artifacts/, and delete files during the 'Close' phase (SKILL.md). - Sanitization: No sanitization or validation logic is specified for the data retrieved from external project files or issues.
- [DATA_EXFILTRATION]: The skill performs broad file system operations, including reading project source code and managing files in a hidden directory within the user's home folder.
- Evidence: The workflow requires reading 'current code' and 'related artifacts' and resolving the absolute path
~/.agents/artifacts/<workspace>/for writing and eventual deletion of files.
Audit Metadata