speckit-plan
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script located at
.specify/scripts/bash/setup-plan.shfrom the repository root to initialize the planning phase. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the
.specify/extensions.ymlconfiguration file to determine which "extension hooks" to execute. If this file is controlled by an attacker, it can trigger arbitrary agent commands. - Ingestion points:
.specify/extensions.ymlfile. - Boundary markers: None identified; the YAML content is parsed and directly used to construct execution instructions.
- Capability inventory: Local shell execution (via
setup-plan.sh) and arbitrary agent command execution (viaEXECUTE_COMMAND). - Sanitization: No validation or sanitization is performed on the hook command names or descriptions parsed from the YAML file.
- [DYNAMIC_EXECUTION]: The skill dynamically constructs agent command strings at runtime by transforming YAML keys (e.g., converting
speckit.git.committo/speckit-git-commit) and then triggers their execution.
Audit Metadata