agent-spec-intent-compiler
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interpret untrusted natural language data from project documentation and issue trackers.
- Ingestion points: The agent reads raw content from
docs/prd.mdand project issue trackers to derive system requirements. - Boundary markers: The skill employs explicit markdown markers (
<!-- agent-spec:requirement ... -->) and utilizes an intermediate 'Candidate Requirement Block' format to isolate drafted content from the verified repository. - Capability inventory: The skill executes numerous
agent-specCLI commands to perform linting, requirement planning, testing, and worktree creation, involving file system writes to.agent-spec/and relative parent directories (../agent-spec-worktrees). - Sanitization: The workflow mandates a human-in-the-loop review for all candidate blocks before integration. Furthermore, it explicitly requires enforcement of 'compiler trust boundaries' which include diagnostics for unsafe IDs and symlinks to prevent unauthorized file system traversal.
Audit Metadata