write-spec
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content from "ordinary requests," "existing agreements," and "deciding evidence" to generate specifications. This represents a potential surface for indirect prompt injection where an attacker could embed malicious instructions within the source data to influence the agent's behavior.\n
- Ingestion points: Untrusted data enters the agent context in
SKILL.md(Step 1) through sources such as "existing agreement identity/revision" and "relevant decisions and sources."\n - Boundary markers: The instructions do not define strict boundary markers or unique delimiters to isolate untrusted inputs from the core system instructions.\n
- Capability inventory: The skill possesses file-writing capabilities to the "authoritative spec home" (
SKILL.md, Step 3) and can publish data to external trackers like GitHub Issues via thesetup-projectcompanion skill (references/publication.md).\n - Sanitization: No explicit sanitization, filtering, or escaping techniques for the ingested text are described in the procedure, relying instead on manual review by the "approval owner."\n- [EXTERNAL_DOWNLOADS]: The skill documentation describes installation via the
npx skills addcommand pointing to the author's GitHub repository. It also implements a discovery mechanism to load "companion" skills (e.g.,shape-work,analyze,domain-modeling,setup-project) from runtime catalogs or approved locations to extend the agent's functionality.
Audit Metadata