importing-a-codebase
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves reading files that specifically carry instructions for AI agents, such as
AGENTS.md,CLAUDE.md,.cursor/rules/*,.cursorrules,.github/copilot-instructions.md,GEMINI.md, and.windsurfrules. This creates a significant surface for indirect prompt injection attacks. - Ingestion points: Identified in Section 1 ("Read first, ask last"), where the agent is instructed to "mine these first" to state intent and conventions.
- Boundary markers: The instructions do not specify the use of delimiters, XML tags, or "ignore embedded instructions" warnings when processing the content of these files.
- Capability inventory: The skill utilizes file-writing capabilities through tools such as
spec_createandeditto generate a documentation graph on the workspace's branch. - Sanitization: There is no evidence of sanitization, escaping, or filtering of the external content retrieved from the workspace files before it is processed by the agent to build its "working model" or draft specifications.
Audit Metadata