craft-spec

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFENO_CODE
Full Analysis
  • [SAFE]: The skill exclusively provides a structured prompt for a Product Manager persona to help users draft specifications. It does not perform any file operations, network requests, or command execution.
  • [NO_CODE]: No executable scripts, binaries, or configuration files are present in the skill.
  • [PROMPT_INJECTION]: The skill processes user-supplied notes through the $ARGUMENTS variable. It utilizes <context> XML-style boundary markers to isolate user input from the primary instructions. Given that the skill lacks any 'allowed-tools' or executable capabilities, the potential for indirect prompt injection to cause harm is non-existent.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 06:45 PM
Security Audit — agent-trust-hub — craft-spec