feature-spec
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
Bashfor local codebase exploration and the GitHub CLI (gh issue create) to create and manage feature specifications. These operations are restricted to the local environment and the project's repository. - [EXTERNAL_DOWNLOADS]: Fetches specifications and guidelines from official and well-known technology sources, including
modelcontextprotocol.ioand documentation hosted on GitHub. - [DATA_EXFILTRATION]: Accesses local project files and sibling directories, such as
../apify-mcp-server-internal, to assess cross-project impact. These resources are part of the vendor's (Apify) development ecosystem and are accessed for legitimate context gathering. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes data from external web pages and local files to generate its output.
- Ingestion points: Local files accessed via
ReadandGlob, and external web content viaWebFetch. - Boundary markers: No specific delimiters are defined in the instructions to separate external data from system instructions.
- Capability inventory: Includes powerful tools like
Bashand theghCLI for system and API interactions. - Sanitization: There is no explicit evidence of sanitization or validation of the ingested external content.
Audit Metadata