product-design-spec
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external and untrusted sources, creating a surface for indirect prompt injection.
- Ingestion points: Data is read from Jira issues (
jira issue view), GitHub issues (gh issue view), and arbitrary remote URLs via theWebFetchtool as part of the 'Phase: Discover' workflow inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore instructions' warnings when processing content from these external sources.
- Capability inventory: The skill has permissions to write and edit files (
Write,Edit) and can execute a local Python script (scripts/screen-states.py) usingBash. - Sanitization: There is no explicit sanitization or validation logic described for the content fetched from external platforms before it is integrated into the design specification.
Audit Metadata