distill
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local workspace to generate specifications, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: The skill reads arbitrary existing source code in Step 3 and Gherkin feature files in Step 4 of the Process Flow defined in SKILL.md.
- Boundary markers: The instructions do not mandate the use of explicit delimiters or instructions to ignore embedded commands when reading source content into the agent's context.
- Capability inventory: The skill possesses the capability to write multiple files to the local file system (including specifications, glossary updates in
beat/CONTEXT.md, and ADRs indocs/adr/) and perform shell execution viagit addandgit commitcommands. - Sanitization: No specific sanitization, filtering, or validation logic is specified for the content extracted from the code or existing documentation before it is processed by the model to generate new artifacts.
Audit Metadata