spec-checklist
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local git commands such as
git status,git add, andgit committo manage the documentation lifecycle. These actions are limited to the project directory and serve the skill's primary purpose. - [DATA_EXFILTRATION]: The skill reads project documentation files. It includes a specific safety instruction to avoid staging sensitive files like
.envor credentials during the git process, which is a positive security practice. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the external documentation files it analyzes.
- Ingestion points: Documentation files located in the
requirements/,design/,implementation/, andverification/folders. - Boundary markers: No explicit boundary markers or 'ignore' instructions are used when parsing content from these files.
- Capability inventory: The skill has the capability to read/write local project files and execute shell-based git commands.
- Sanitization: There is no content validation or sanitization of the documentation content being processed.
Audit Metadata