to-spec
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from the conversation history and repository content to generate a technical specification that is subsequently published to an external project issue tracker. This creates an attack surface where malicious or misleading content in the conversation context could influence the generated output or cause the agent to include unintended instructions in the published issue.
- Ingestion points: Conversation context and codebase content are used to produce the specification (defined in
SKILL.md). - Boundary markers: The skill lacks explicit delimiters or "ignore embedded instructions" markers for the ingested conversation data.
- Capability inventory: The skill can write and publish content to the project's external issue tracker.
- Sanitization: The skill includes an explicit instruction to the model: "The spec must contain only feature-relevant content: never include credentials, keys, tokens, environment values, personal data, or conversation details unrelated to the feature."
Audit Metadata