technical-design-doc-creator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is purely instructional and guides the agent to generate technical documentation. It does not contain any code execution, remote downloads, or credential harvesting patterns.
- [SAFE]: The instructions include a 'High-Level vs Implementation' principle that explicitly forbids the agent from including CLI commands or code snippets in the documentation, which mitigates the risk of a user accidentally executing malicious code suggested in a TDD.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data to generate documentation, creating a potential surface for indirect injection.
- Ingestion points: User project descriptions and interactive responses collected via the
AskQuestiontool defined inSKILL.md. - Boundary markers: Absent; user input is directly interpolated into the TDD Markdown template.
- Capability inventory: The skill is limited to text generation and offers an optional integration to publish documents to Confluence.
- Sanitization: The skill enforces strict architectural guidelines, requiring the agent to filter out implementation-specific details and focus only on high-level contracts and decisions.
- [SAFE]: The skill mandates a 'Security Considerations' section for payment and authentication projects, specifically requiring documentation of PII handling, encryption standards, and compliance (PCI DSS, GDPR), which encourages secure system design.
Audit Metadata