to-spec

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes current conversation history and codebase context to generate and publish project specifications. This creates a surface for indirect prompt injection where malicious instructions embedded in the conversation could be synthesized into the output.
  • Ingestion points: Current conversation context and codebase understanding as described in the Process section of SKILL.md.
  • Boundary markers: Absent; the skill does not define specific delimiters or instructions for the agent to ignore embedded commands within the conversation history.
  • Capability inventory: File system read access (referenced documents in docs/ and references/) and the ability to publish issues to an external tracker.
  • Sanitization: Absent; no explicit validation or sanitization steps are defined for the ingested conversation data.
  • [COMMAND_EXECUTION]: The skill provides instructions to "publish it to the project issue tracker" and mentions running /setup-quirk-skills. These actions imply the execution of underlying CLI tools or agent commands to interact with external project management systems.
  • [METADATA_POISONING]: There is a minor inconsistency between the YAML frontmatter and the skill body. The frontmatter lists sideEffects: [], whereas the process instructions explicitly involve publishing to an external issue tracker, which is a side effect.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 03:00 AM
Security Audit — agent-trust-hub — to-spec