plan
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted external content.
- Ingestion points: The orchestrator reads design specifications from 'docs/specs/' (SKILL.md Step 1) and research agents scan codebase files for data models and interfaces (SKILL.md Step 4).
- Boundary markers: There are no instructions or delimiters in the agent prompts (such as the File Mapper or Interface Scanner) to prevent the LLM from obeying instructions embedded within the spec overview or codebase snippets.
- Capability inventory: The skill possesses capabilities to write files (SKILL.md Step 8), execute shell commands (SKILL.md Step 0), and dispatch further agents. These capabilities could be misused if an injection occurs. Furthermore, the skill encourages autonomous execution via the '/implement --auto' command (SKILL.md Step 12).
- Sanitization: Content extracted from specs (overview, acceptance criteria, data models) is directly interpolated into agent prompts and written to the output plan files without sanitization or escaping.
- [COMMAND_EXECUTION]: The skill utilizes the 'Bash' tool for project initialization checks and research tasks (SKILL.md Step 0 and Step 4). While these functions are consistent with the skill's purpose as a developer tool, executing shell commands based on patterns extracted from untrusted design specifications (e.g., using Grep to search for entities named in the spec) creates a surface for command injection if inputs are not strictly validated.
Audit Metadata