specify
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing untrusted data from the repository, external issues, and command outputs to build an evidence register.
- Ingestion points: Data enters the context from repository files, existing specifications, issue text, and command output as described in the 'Security Model' section of SKILL.md.
- Boundary markers: The skill explicitly instructs the agent to maintain an 'Instruction boundary,' treating external text as data rather than instructions to prevent unauthorized command execution or route changes.
- Capability inventory: The skill utilizes read-only shell commands and can spawn a read-only subagent for a 'fresh-reader' check. It only writes the specification file and associated metadata if specific tools like
scope-checkare present. - Sanitization: The skill relies on its internal logic to enforce that credentials are never recorded in the output, using placeholders instead of actual values.
Audit Metadata