to-spec-plus
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes external, potentially untrusted data from the repository.
- Ingestion points: Reads
CONTEXT.md,ADRs,docs/agents/issue-tracker.md,AGENTS.md,CLAUDE.md, and general codebase files. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the files it reads.
- Capability inventory: The skill can interact with external issue trackers using the
gh(GitHub CLI) tool or the Linear MCP, and can write files to the local.scratch/directory. - Sanitization: No explicit sanitization or escaping of the ingested content is mentioned.
- Mitigation: The instructions include a robust mitigation by requiring the agent to show the draft to the user and obtain explicit confirmation before performing any external publishing actions.
Audit Metadata