speckit-analyze
Warn
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script located at
.specify/scripts/bash/check-prerequisites.shduring the initialization phase. - [DYNAMIC_EXECUTION]: The skill implements a hook system that reads
.specify/extensions.ymland automatically executes commands defined underhooks.before_analyzeandhooks.after_analyze. This allows for arbitrary command execution based on the contents of a local configuration file. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and semantically analyzes multiple user-provided markdown files (
spec.md,plan.md,tasks.md) and a constitution file. While it includes 'Strictly Read-Only' constraints, these files could contain adversarial content intended to influence the agent's logic or findings during the analysis process.
Audit Metadata