specification
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to generate an HTML file from a local template, save it to a temporary path, and open it in a browser. This functionality is intended for local human-in-the-loop review of specification data and does not involve remote execution or persistent system changes.\n- [PROMPT_INJECTION]: The skill ingests user-provided intent and feature requests to build its specification map. It identifies the risk of processing untrusted data by including an explicit security instruction to escape HTML characters (specifically '<' as backslash-u003c) in the generated review page, which serves as a mitigation against indirect prompt injection or cross-site scripting (XSS) in the generated local artifact.
Audit Metadata