to-spec
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted data from the repository and conversation history.
- Ingestion points: The skill reads "current conversation context" and explores the "repo" to understand the "current state of the codebase" (
SKILL.md). - Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions potentially embedded within the codebase files being analyzed.
- Capability inventory: The agent has the capability to "explore the repo" and "publish [the spec] to the project issue tracker" (
SKILL.md). - Sanitization: No sanitization or validation of the ingested content is described before it is synthesized into the final spec template and published externally.
Audit Metadata