implement-spec
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external specification and ticket data to guide the implementation process, representing a standard surface for indirect instructions.\n
- Ingestion points: Specification files and issue tracker ticket data processed as described in SKILL.md.\n
- Boundary markers: The instructions do not define specific delimiters or warnings to ignore instructions embedded in the specifications or tickets.\n
- Capability inventory: The agent uses subagents with capabilities to write files (saving exploration notes), execute git commands (branching, merging), and invoke other tools like
tddandcode-review.\n - Sanitization: No explicit sanitization or validation of the input specification data is specified.\n- [EXTERNAL_DOWNLOADS]: The documentation includes installation commands that fetch the skill collection from the author's repository.\n
- Evidence: Mentions
npx skills add light-cheng/skills-3rdParty#v0.3.1in UPSTREAM.md.
Audit Metadata