spec-improve
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's operations are consistent with its stated purpose of auditing and improving specifications. It accesses local documentation files such as
CLAUDE.mdandAGENTS.mdto ensure project-specific terminology and conventions are respected during the audit process. - [COMMAND_EXECUTION]: The
Bashtool is used to executegit remote get-url originto identify the repository. This is a standard utility for developer tools and does not involve arbitrary command execution from untrusted sources. - [EXTERNAL_DOWNLOADS]: The skill interacts with well-known external project management platforms (Jira, Linear, GitHub) via MCP tools. These interactions are scoped to fetching and updating issue data based on user-provided identifiers and do not involve untrusted remote code execution.
- [PROMPT_INJECTION]: The skill ingests data from external sources (ingestion points:
atlassian:getJiraIssue,github:get_issue,Read). Although explicit boundary markers are not mentioned, the risk of indirect prompt injection is low due to the highly structured nature of the audit and rewrite phases, which focus the model on specific metadata and rubric dimensions rather than executing instructions contained within the fetched content.
Audit Metadata