evidence-gap-review
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is a utility for specification management and does not exhibit any malicious behavior. Its instructions are focused on interpreting tool output and providing helpful feedback to the user.
- [COMMAND_EXECUTION]: The skill instructs the agent to run
specgraph verifyandspecgraph explain. These are legitimate uses of an auditing tool to gather status and metadata about specifications within the user's project environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external CLI tool that parses source code annotations, creating an attack surface for indirect prompt injection. However, the risk is minimal as the agent's capabilities are restricted to generating reports and further diagnostic commands.
- Ingestion points: Tool output from
specgraph verify(SKILL.md) - Boundary markers: None specified for input processing.
- Capability inventory:
specgraph verify,specgraph explain(SKILL.md) - Sanitization: Not present.
Audit Metadata