gpt-engineer-spark
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to manage repository state and execute subagent tasks. This involves calling Git for worktree management and the Codex CLI for model interaction.\n - Evidence:\n
scripts/run_spark_agent.pyusessubprocess.Popento execute the Codex CLI with specific sandbox and model parameters.\nscripts/bootstrap.pyandscripts/run_spark_agent.pyusesubprocess.runto perform Git operations like cloning, diffing, and committing.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts by passing them to subagents. While it provides boundary markers to scope subagent behavior, this creates an inherent attack surface for indirect prompt injection via repository content or malicious task descriptions.\n- Ingestion points: User input is read from stdin or files in
scripts/run_spark_agent.py.\n - Boundary markers: The script prepends specific instructions to subagent prompts to define their role and authority.\n
- Capability inventory: Subagents are constrained to isolated worktrees with network access disabled via CLI flags (
--config sandbox_workspace_write.network_access=false).\n - Sanitization: The skill relies on the underlying agent's safety filters and the provided sandbox configurations rather than explicit prompt sanitization.
Audit Metadata