to-spec
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions define a benign workflow for generating a project specification from existing context. It does not exhibit malicious behavior such as unauthorized command execution, data exfiltration, or obfuscation.
- [SAFE]: While the skill ingests potentially untrusted data from the conversation and codebase, it incorporates a human-in-the-loop mitigation by requiring the agent to check with the user before proceeding to publish the final specification.
- Ingestion points: Conversation context and repository files as mentioned in SKILL.md.
- Boundary markers: Not present.
- Capability inventory: Repository exploration (file-read) and publishing to an issue tracker (write).
- Sanitization: Content is synthesized into a template; no explicit escaping is defined, but the user review step acts as a control.
Audit Metadata