Skills
skills/zixun-github/aisdlc/spec-merge-back/Gen Agent Trust Hub

spec-merge-back

Pass

Audited by Gen Agent Trust Hub on Mar 10, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted data from the {FEATURE_DIR}/implementation/plan.md file to determine which assets to promote to the project SSOT. This ingestion surface lacks explicit boundary markers and sanitization, creating a surface for indirect prompt injection. 1. Ingestion points: {FEATURE_DIR}/implementation/plan.md (Step 1). 2. Boundary markers: Absent. 3. Capability inventory: File writing to .aisdlc/project/ and {FEATURE_DIR}/merge_back.md. 4. Sanitization: Absent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 10, 2026, 07:29 AM