validating-specs
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core function involves processing untrusted documents and user-defined criteria, which establishes a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted content is ingested via the SPEC_ABS_PATHS (review targets) and PROJECT_CHECKS (custom criteria) fields, which are passed to sub-agents in prompts/validator-instance.md.
- Boundary markers: The skill utilizes structural delimiters () and character-level JSON escaping (\u003c, \u003e, \u0026) to prevent untrusted criteria from escaping their intended data context.
- Capability inventory: The skill has capabilities for repository file reading, searching, documentation lookup via MCP servers (e.g., context7), and report writing. It manages sub-agent lifecycles using spawn and wait tools.
- Sanitization: The references/validator-role.md defines a 'Review authority' mechanism that scans for 'redirections' (malicious instructions in data), requiring the agent to ignore them and paraphrase them in reports to prevent downstream execution.
- [DYNAMIC_EXECUTION]: The skill dynamically assembles instruction sets for worker instances by populating a prompt template with runtime variables.
- Evidence: SKILL.md Step 5 (Dispatch) describes filling the prompts/validator-instance.md template with absolute paths, tool assignments, and doc-type classifications before dispatching a fresh child agent.
Audit Metadata