recursive-spec
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the repository's codebase and existing documentation (STATE.md, DECISIONS.md, etc.) to co-author requirements. This process is susceptible to indirect prompt injection if malicious instructions are present in the files being read.\n
- Ingestion points: Reads repository files including STATE.md, DECISIONS.md, MEMORY.md, and application code as specified in the 'Required Read Behavior' section of SKILL.md.\n
- Boundary markers: The skill follows a strict template but does not explicitly define delimiters for external content during the drafting phase to isolate it from agent instructions.\n
- Capability inventory: The skill can write files and execute local initialization scripts (recursive-init.py or recursive-init.ps1).\n
- Sanitization: No explicit sanitization, filtering, or validation of codebase content is mentioned in the instructions.\n
- Mitigation: The skill enforces a mandatory 'Draft Handling Before Approval' workflow, ensuring no repository changes are made or scripts are executed until the user explicitly reviews and approves the draft.\n- [COMMAND_EXECUTION]: The skill executes local scripts to initialize run folders after the user approves the drafted requirements.\n
- Evidence: SKILL.md instructs the agent to 'Create the run with .recursive/scripts/recursive-init.py or .recursive/scripts/recursive-init.ps1'.\n
- The execution is limited to local scripts within the vendor's established repository structure.
Audit Metadata