mcp-server-spec-driven-development
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation process utilizes
npxto download and execute themcp-server-spec-driven-developmentpackage from the official NPM registry. This package is a resource associated with the author. - [COMMAND_EXECUTION]: The skill facilitates the automated creation of directories (such as
specs/) and the generation of multiple source code files in the project directory based on provided specifications. - [PROMPT_INJECTION]: The design involves a multi-stage pipeline where data from requirements and design documents is read to drive code generation. This creates an indirect prompt injection surface.
- Ingestion points: The agent reads untrusted data from
specs/requirements.mdandspecs/design.mdto inform subsequent stages. - Boundary markers: The prompt descriptions do not specify the use of delimiters or explicit instructions for the agent to ignore embedded commands in the specification files.
- Capability inventory: The skill has the capability to write multiple files to the local file system.
- Sanitization: There is no mention of sanitization or validation of the content read from specification files before it is processed during the generation phase.
Audit Metadata