team-implement
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes requirements from external sources such as Jira issues, GitHub PRs, and URLs in Phase 0. This ingested content is then used to prompt agents (Product Lead, Architect) to generate code and architecture. This creates a surface for indirect prompt injection where malicious instructions could be embedded in external requirements to influence the agent's output.
- Ingestion points: Data is fetched from Jira, GitHub, and remote URLs using
WebFetchand CLI tools as defined inreferences/spec-workflow.md. - Boundary markers: While the workflow is structured, the agent prompts do not explicitly contain instructions to ignore potential commands embedded in the ingested data.
- Capability inventory: The agents have access to powerful tools like
Bash,Write, andEdit, enabling them to modify the codebase based on the generated plans. - Sanitization: There is no dedicated sanitization or filtering of the ingested requirement text prior to processing.
Audit Metadata