spec-grill
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/extract-signals.jsexecutes thegitcommand usingnode:child_process.execFileSyncto retrieve commit history from the target repository. This is a standard development operation and uses a safe method that avoids shell interpolation.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from the repository being analyzed (e.g., documentation and commit messages) to seed its capability suggestions, creating a potential surface for indirect prompt injection.\n - Ingestion points:
README.md,spec/charter.md, and git log data processed inscripts/extract-signals.js.\n - Boundary markers: The skill mandates the generation of a diagnostic "Grill Report" and requires explicit human confirmation before any modifications are written to the filesystem.\n
- Capability inventory: Local file reads,
git logcommand execution, and file writing tospec/capabilities.md.\n - Sanitization: Instructions require the agent to apply a "3-Axis Predicate Test" (Authority, Distributional, and Manipulability axes) to verify that proposed behaviors and constraints align with user intent and are resistant to agent manipulation.
Audit Metadata