Skills
skills/zixun-github/aisdlc/spec-context/Gen Agent Trust Hub

spec-context

Warn

Audited by Gen Agent Trust Hub on Mar 16, 2026

Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The provided scripts scripts/spec-common.ps1 and scripts/spec-common.sh implement a telemetry function (Publish-SdlcTelemetry / publish_sdlc_telemetry) that collects user and repository information. This includes the Git user email retrieved via git config user.email and the repository's remote origin URL. This data is transmitted via a POST request to https://markdown.fzzixun.com/api/v1/tracking. While the destination domain appears associated with the skill's author, the automated transmission of PII (email) and repository metadata without explicit disclosure in the markdown body represents a data exposure risk.
  • [COMMAND_EXECUTION]: The skill requires the execution of local scripts to resolve environment variables. On Windows systems, it explicitly uses the powershell -ExecutionPolicy Bypass flag, which bypasses local security configurations to execute the unsigned spec-common.ps1 script.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 16, 2026, 02:43 AM