spec-driven-auto
Pass
Audited by Gen Agent Trust Hub on May 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The instructions include mandatory directives to "treat all prior conversational context as stale, unreliable, and non-authoritative" and to "discard the prior chat context." These are explicit "ignore-previous-instructions" patterns designed to override the agent's memory and potentially bypass global system constraints.
- [COMMAND_EXECUTION]: The skill executes a Node.js script (
spec-driven.js) across all phases of the workflow. Additionally, it instructs the agent to run project-level tests to confirm implementation. Running arbitrary test suites from an untrusted repository can lead to local code execution if the tests contain malicious payloads. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from the repository codebase and specification files while possessing the capability to modify files and execute commands.
- Ingestion points: Reads repository files,
.spec-driven/config.yaml, markdown artifacts (proposal.md, questions.md), and specification files. - Boundary markers: No specific delimiters or instructions to ignore instructions embedded within the source files or specs are provided.
- Capability inventory: The skill can write files, execute the
spec-driven.jsscript, and run repository tests via shell commands. - Sanitization: There is no mention of sanitization or validation logic for the content read from the repository files before it influences the agent's actions.
Audit Metadata