grace-spec
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It collects user input through an interview process and interpolates it directly into XML specification files (spec.xml). Because these files define components like 'ExpectedCommand' used by downstream processes (e.g., grace-plan), a malicious user could inject instructions to influence future agent actions or tool executions. \n
- Ingestion points: User-provided responses during the interview workflow (specifically Summary, Goals, and ExpectedCommand fields). \n
- Boundary markers: Absent; templates in the references directory use basic string interpolation without data isolation or delimiters. \n
- Capability inventory: The skill creates and writes files within the local project structure (.grace/changes/active/). \n
- Sanitization: No input validation, sanitization, or XML-specific escaping is applied to user responses.\n- [COMMAND_EXECUTION]: The skill includes instructions to recommend the 'grace lint' command to the user for manual execution. It does not perform automatic shell command execution or possess capabilities for direct system manipulation beyond file creation.
Audit Metadata