skills/c0nant/skills/to-spec/Gen Agent Trust Hub

to-spec

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (conversation context, codebase content, and docs/agents/issue-tracker.md) to generate a specification. While it uses a structured template, a malicious codebase or document could attempt to influence the agent's behavior during the synthesis process.
  • Ingestion points: Conversation context, docs/agents/issue-tracker.md, and repo files.
  • Boundary markers: The skill uses a defined <spec-template> which helps structure the output.
  • Capability inventory: Shell command execution via gh issue create and glab issue create.
  • Sanitization: Not explicitly defined in instructions, relying on the platform's standard CLI tool handling.
  • [COMMAND_EXECUTION]: The skill uses gh (GitHub CLI) and glab (GitLab CLI) to create issues. These are standard developer tools and used for the skill's primary stated purpose, though they provide a mechanism for the agent to interact with external services.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 03:06 PM
Security Audit — agent-trust-hub — to-spec