cy-spec-preflight
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
scripts/check-prd-implementation-leak.pyandscripts/check-techspec-markers.py) to perform quality checks on markdown documents. These scripts use standard libraries and operate strictly on provided file paths. - [DATA_EXPOSURE]: The skill reads various project files, including project memory (
docs/_memory/), active context (.compozy/tasks/), and configuration files (CLAUDE.md). This access is necessary for its stated purpose of building project context and is limited to the local file system. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading PRDs, TechSpecs, and analysis files which could theoretically contain malicious instructions. However, the skill treats this data as content to be analyzed rather than instructions to be followed, and its primary capabilities are limited to invoking subsequent creation skills. This represents a low-risk surface common to documentation processing tools.
Audit Metadata