security-requirement-extraction
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external threat data and business context to generate security requirements, user stories, and test specifications. Malicious instructions within the provided threat inputs could be propagated into the generated output.\n
- Ingestion points:
ThreatInputandSecurityRequirementdata structures inSKILL.md.\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content within the input data.\n
- Capability inventory: The skill lacks dangerous capabilities such as file system access, network operations, or dynamic code execution; its primary function is string manipulation and markdown generation.\n
- Sanitization: The code templates use direct string interpolation (e.g.,
.format()and f-strings) without sanitization or validation of the input content.
Audit Metadata