foundry-security-spec
Pass
Audited by Gen Agent Trust Hub on May 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation instructs the user to install
@github/spec-kit. This package originates from a well-known service (GitHub), which is recognized as a trusted source for development tools. The installation is a standard part of the spec-driven development workflow described in the implementation guide. - [DATA_EXFILTRATION]: The implementation examples demonstrate integration patterns where security findings are transmitted to internal services, such as Jira or GitLab, using credentials retrieved from environment variables. This functionality is consistent with the primary purpose of the 'Publisher' agent role within the framework's architecture.
- [COMMAND_EXECUTION]: The provided Python snippets illustrate patterns for executing code within isolated sandbox runtimes to validate security hypotheses. These operations are explicitly described as occurring within controlled environments with network and resource isolation (e.g., Docker containers).
- [PROMPT_INJECTION]: The framework architecture is designed to process untrusted source code and external security claims. The specification includes a 'Constitution' and 'Evidence Gates' to mitigate potential indirect prompt injection attacks by requiring explicit evidence, reproducibility, and human-in-the-loop checkpoints.
Audit Metadata