spec-design

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of ingesting and summarizing external documentation.
  • Ingestion points: The agent is instructed to read content from {FEATURE_DIR}/requirements/solution.md, project/memory/*, project/components/*.md, and project/adr/*.md (SKILL.md).
  • Boundary markers: While the skill enforces the use of a specific template (assets/design-template.md) and logical checks like CONTEXT GAP, it lacks explicit prompt-level delimiters (e.g., XML tags or unique string markers) to separate untrusted file content from the agent's internal instructions.
  • Capability inventory: The skill has the capability to write files to the local file system at {FEATURE_DIR}/design/design.md.
  • Sanitization: There is no evidence of content sanitization or validation of the input data before it is interpolated into the design document.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 08:08 AM
Security Audit — agent-trust-hub — spec-design