spec
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script located at
<plugin root>/scripts/prose-lint.pyto validate the generated specification file. While this is a standard linting workflow, it involves the execution of code within the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided feature requests and existing repository documentation to generate specifications, creating a surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through user commands (e.g.,
/spec) and by reading existing specification files in the repository. - Boundary markers: The skill uses a structured workflow that identifies "marked assumptions" and "open questions," but it lacks explicit delimiters (like XML tags or triple quotes) to isolate external input from instructions.
- Capability inventory: The skill has the capability to write files to the repository (
docs/product-specs/) and execute a local validation script (prose-lint.py). - Sanitization: There is no mention of sanitization, escaping, or filtering of the user-provided feature requests before they are processed by the agent.
Audit Metadata