spec-driven-development
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a set of instructional guidelines for an AI agent to follow a structured development workflow. It focuses on requirements gathering, planning, and implementation gated by human review.
- [PROMPT_INJECTION]: No instructions were found that attempt to override system prompts, bypass safety filters, or extract sensitive information.
- [DATA_EXFILTRATION]: The skill does not contain any commands for accessing sensitive local files (e.g., credentials, SSH keys) or performing unauthorized network requests. It explicitly advises against committing secrets in its "Boundaries" section.
- [REMOTE_CODE_EXECUTION]: There are no patterns involving the download or execution of remote scripts or unverifiable dependencies. The commands mentioned (e.g.,
npm test) are provided as examples for the user's local project workflow. - [OBFUSCATION]: No obfuscated content, encoded strings, or hidden characters were detected in the instructions.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves processing human requirements (external data), the workflow emphasizes clarification questions and human approval checkpoints, which serves as a robust boundary against unintended command execution from requirement inputs.
Audit Metadata