recipe-update-doc
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes existing documents from specific directories (docs/design/, docs/prd/, docs/adr/) and user-provided $ARGUMENTS, both of which could contain malicious embedded instructions. These contents are passed directly into prompts for sub-agents without sanitization or boundary markers to prevent the agent from obeying instructions found within the data.
- Ingestion points: File discovery and content reading performed in Steps 1, 2, and 3 (SKILL.md).
- Boundary markers: Absent. The orchestration logic explicitly calls for mechanical extraction and verbatim copying of content into sub-agent prompt fields.
- Capability inventory: The orchestrator invokes multiple specialized sub-agents (technical-designer, prd-creator, code-verifier, document-reviewer, design-sync) which possess the capabilities to generate and modify technical artifacts.
- Sanitization: Absent. There is no evidence of escaping, filtering, or validation of the ingested document content before it is interpolated into sub-agent prompts.
Audit Metadata