crank-spec
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill creates temporary markdown files using the
mktemputility to store draft specifications without cluttering the working directory. - [COMMAND_EXECUTION]: To facilitate the interactive review process, the skill uses platform-specific commands to open generated HTML files in the user's default browser, specifically using
openon macOS,xdg-openon Linux, andstarton Windows. - [EXTERNAL_DOWNLOADS]: The generated HTML review page fetches the Tailwind CSS framework and the Mermaid.js diagramming library from well-known content delivery networks, including jsDelivr and unpkg.
- [DATA_EXFILTRATION]: The local absolute file path of the temporary specification is embedded as a data attribute in the generated HTML and is included in the review comments when the user manually exports and pastes them back to the agent. This behavior is used to maintain a reference to the source file during the feedback loop.
Audit Metadata