spec-kitty-tasks
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The project constitution (rules/constitution.md) establishes a 'Human Gate' requiring explicit user approval ('Proceed', 'Go', or 'Execute') for any operation that writes to disk, modifies version control, or executes commands with side effects. This is a primary safety mechanism against automation risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from specification and planning documents to generate work packages. 1. Ingestion points: kitty-specs/###-feature/spec.md and plan.md. 2. Boundary markers: Absent. 3. Capability inventory: Git commits, file writes, and CLI execution via spec-kitty. 4. Sanitization: Absent. This potential surface is mitigated by the mandatory Human Gate policy.\n- [DYNAMIC_EXECUTION]: The skill incorporates hardcoded Python validation snippets in its templates (e.g., templates/merge.md) to ensure correct worktree locations and data integrity. These scripts are used for internal state validation and do not process unsanitized remote input.
Audit Metadata