Skills
skills/teachingai/full-stack-skills/speckit-clarify/Gen Agent Trust Hub

speckit-clarify

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local repository script at .specify/scripts/bash/check-prerequisites.sh to determine project paths. This script is part of the vendor's local toolset.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes external specification files without using delimiters or sanitization. 1. Ingestion points: Reads the file specified by FEATURE_SPEC. 2. Boundary markers: Absent. 3. Capability inventory: Local bash script execution and file system write access. 4. Sanitization: No validation or escaping of the spec content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 10:48 AM