to-spec
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from conversation history and codebase files to generate structured specifications, creating a potential surface for indirect injection.
- Ingestion points: Conversation history and repository files (Step 1 in SKILL.md).
- Boundary markers: The skill uses a structured for its output but does not define explicit boundary markers for the untrusted input data it reads.
- Capability inventory: The skill has the capability to publish content to external project issue trackers (Step 3 in SKILL.md).
- Sanitization: Instructions advise the model not to include specific code snippets or file paths to avoid stale or sensitive data exposure, though no programmatic sanitization is performed. This attack surface is inherent to the skill's primary function.
- [SAFE]: The skill is designed with user-in-the-loop verification (checking implementation seams with the user before publishing) and provides clear templates to ensure output consistency and safety.
Audit Metadata