spec-kitty-tasks

Pass

Audited by Gen Agent Trust Hub on Mar 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The project constitution (rules/constitution.md) establishes a 'Human Gate' requiring explicit user approval ('Proceed', 'Go', or 'Execute') for any operation that writes to disk, modifies version control, or executes commands with side effects. This is a primary safety mechanism against automation risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from specification and planning documents to generate work packages. 1. Ingestion points: kitty-specs/###-feature/spec.md and plan.md. 2. Boundary markers: Absent. 3. Capability inventory: Git commits, file writes, and CLI execution via spec-kitty. 4. Sanitization: Absent. This potential surface is mitigated by the mandatory Human Gate policy.\n- [DYNAMIC_EXECUTION]: The skill incorporates hardcoded Python validation snippets in its templates (e.g., templates/merge.md) to ensure correct worktree locations and data integrity. These scripts are used for internal state validation and do not process unsanitized remote input.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 14, 2026, 08:59 AM