codex-spec-interviewer
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data, including user requests, repository files (READMEs, issue descriptions, ADRs), and external documentation via web search or MCP tools. While the skill follows a structured workflow to generate implementation specs, it lacks explicit sanitization or boundary markers (e.g., XML tags or clear 'ignore instructions' warnings) when interpolating this external data into its internal reasoning process.
- Ingestion points: User requests,
AGENTS.md,README.md, issue descriptions, ADRs, and external documentation (SKILL.md, references/workflow-details.md). - Boundary markers: Absent. The skill relies on structured templates (assets/*.md) for output but does not define markers to isolate ingested content from instructions.
- Capability inventory: The skill uses tools for file reading, code searching, and external web/MCP lookups. It performs file writes to persist documentation artifacts (specs and ADRs).
- Sanitization: Absent. There is no mention of escaping or filtering external content before processing or inclusion in artifacts.
Audit Metadata