recipe-design
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data and transmits it to sub-agents without sanitization or boundary enforcement, potentially allowing malicious instructions embedded in source documents to influence the agent's behavior.
- Ingestion points: Data enters the workflow via the
$ARGUMENTSvariable (assigned torequirements) and via external files referenced by theprd_path(Step 1 and Step 2). - Boundary markers: The instructions lack explicit boundary markers or delimiters for untrusted content. Instead, the skill mandates "mechanical extraction" and instructions the agent to "copy the named source values into the exact fields" and "invoke immediately."
- Capability inventory: The skill utilizes several powerful sub-agents, including
dev-workflows:codebase-analyzer(capable of repository-wide analysis) anddev-workflows:technical-designer(capable of generating implementation documents). - Sanitization: There is an explicit lack of sanitization; the skill repeatedly instructs that inputs like
requirementsandcodebase_analysisJSON be used "verbatim" and "unchanged" (Step 2, Step 3, Step 5).
Audit Metadata