to-spec
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes current conversation history and codebase context to generate and publish project specifications. This creates a surface for indirect prompt injection where malicious instructions embedded in the conversation could be synthesized into the output.
- Ingestion points: Current conversation context and codebase understanding as described in the Process section of
SKILL.md. - Boundary markers: Absent; the skill does not define specific delimiters or instructions for the agent to ignore embedded commands within the conversation history.
- Capability inventory: File system read access (referenced documents in
docs/andreferences/) and the ability to publish issues to an external tracker. - Sanitization: Absent; no explicit validation or sanitization steps are defined for the ingested conversation data.
- [COMMAND_EXECUTION]: The skill provides instructions to "publish it to the project issue tracker" and mentions running
/setup-quirk-skills. These actions imply the execution of underlying CLI tools or agent commands to interact with external project management systems. - [METADATA_POISONING]: There is a minor inconsistency between the YAML frontmatter and the skill body. The frontmatter lists
sideEffects: [], whereas the process instructions explicitly involve publishing to an external issue tracker, which is a side effect.
Audit Metadata