write-feature-docs
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from external spec files (PRODUCT.md, TECH.md) which may contain instructions designed to influence agent behavior.
- Ingestion points: Reads local spec files at
specs/<id>/as specified in Step 1. - Boundary markers: Includes an interactive outline confirmation step (Step 3) where the engineer must approve the plan before drafting.
- Capability inventory: Shell execution (git, gh), PR creation, and optional GUI interaction (computer_use).
- Sanitization: Content derived from
TECH.mdis flagged for review or replaced with placeholders in ambient mode to prevent accidental exposure of internal implementation details. - [COMMAND_EXECUTION]: The skill executes multiple shell commands to interact with GitHub and the local file system.
- Evidence: Uses
gh search code,gh pr list,gh api, andgit logto discover information and automate workflows. - Mitigation: Implements regex-based input validation (
^[A-Za-z0-9][A-Za-z0-9_-]*$) for user-provided spec IDs and feature tokens to mitigate shell injection risks. - Mitigation: Mandates the use of
gh pr create --body-fileto prevent shell interpretation and corruption of PR description content.
Audit Metadata