to-spec
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from various repository files, including glossaries, Architectural Decision Records (ADRs), and issue tracker configurations, to synthesize a specification document.\n
- Ingestion points: The skill reads docs/agents/issue-tracker.md, docs/agents/triage-labels.md, GLOSSARY.md, and project ADRs from the local environment.\n
- Boundary markers: The instructions lack explicit delimiters or instructions to ignore embedded commands or behavioral overrides within the processed repository data.\n
- Capability inventory: The agent has the capability to explore the repository and publish generated content to external services.\n
- Sanitization: No sanitization, validation, or filtering of the ingested repository content is performed before synthesis.\n- [DATA_EXFILTRATION]: The skill uses configuration found within the codebase to identify external targets for publishing synthesized conversation data.\n
- Network operations: The skill attempts to publish specifications to an issue tracker URL obtained from the local docs/agents/issue-tracker.md file.\n
- Sensitive Data: The skill summarizes conversation context into a spec and sends it to the dynamically determined endpoint, which could lead to exfiltration if the configuration file is malicious.
Audit Metadata