product-spec-to-implementation
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is composed of purely instructional content in Markdown format, defining workflows for product-to-implementation transitions and business artifact handoffs. There are no executable scripts, system commands, or binary files included.
- [INDIRECT_PROMPT_INJECTION]: The instructions involve processing untrusted external data such as Product Requirement Documents (PRDs) and design notes. This creates an ingestion surface for indirect prompt injection. However, the skill lacks any capabilities (such as network access or shell execution tools) that would allow a malicious payload within those documents to perform harmful actions. The guidance explicitly instructs the agent to differentiate between user-supplied facts and model inferences, which serves as a conceptual boundary against automated obedience to embedded instructions.
Audit Metadata