derive
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill uses standard file system tools (Read, Write, Grep, Glob) to transform specification documents into test structures and templates.
- [PROMPT_INJECTION]: The skill contains no instructions attempting to bypass safety filters or override agent behavior. It includes explicit 'Anti-Hallucination Rules' and 'Core Principles' that enforce strict 1:1 mapping between specifications and generated content, which acts as a functional safeguard.
- [DATA_EXFILTRATION]: No network access or data exfiltration patterns were identified. The skill does not use network tools like
curlorwget, and it targets standard documentation and test file paths without accessing sensitive configuration directories. - [COMMAND_EXECUTION]: No arbitrary command execution patterns were found. The skill instructions focus on content transformation and template generation.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and standards from the author's public GitHub repository (
AsiaOstrich/universal-dev-standards). These are informational links and do not involve executing remote code or scripts. - [DATA_INGESTION]: While the skill processes untrusted specification files (representing an Indirect Prompt Injection surface), it implements traceability requirements and 'Source' tagging for all outputs. This allows for clear human verification of the origin of all generated content, mitigating risks associated with processing external data.
Audit Metadata