skills/b4r7x/nuke-skills/nuke-spec/Gen Agent Trust Hub

nuke-spec

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill implements a preflight protocol in references/preflight.md that allows the agent to execute shell commands to resolve environmental blockers. This includes attempting to fix missing dependencies or correcting tool commands to ensure that gates (tests, linters, and type-checkers) can run successfully.
  • [EXTERNAL_DOWNLOADS]: As part of the environmental unblocking process, the skill may invoke package managers such as npm, pip, go, or cargo to install dependencies required for codebase analysis and validation. This is governed by the manifests found within the project repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including user-provided feature descriptions, notes files, and issue exports.
  • Ingestion points: Primary command arguments and notes files read during Phase 0 (Recon).
  • Boundary markers: The protocol uses a clarifying question phase (Phase 0) and multi-tier review cycles (Phase 3) to validate requirement interpretation.
  • Capability inventory: The skill can execute shell commands for gates and environment setup, and write files to the .nuke/ directory.
  • Sanitization: The skill relies on model-tier escalation (using 'session' or 'top' tiers for review) and a manual confirmation gate (--ask) to mitigate potential logic injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 07:40 PM
Security Audit — agent-trust-hub — nuke-spec