specify
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONTIME_DELAYED_CONDITIONAL
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
npm run spec:gate <path>to validate that the generated specification files meet the project's quality standards and template requirements. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user feature requests and reads project-specific documentation, such as
02-DOCS/wiki/harness/user-profile.mdand02-DOCS/wiki/sdd/constitution.md, to set context. While it uses a 'restate intent' pattern to align with the user, it lacks explicit sanitization for external content interpolated into the specifications. - [DYNAMIC_EXECUTION]: To avoid bias during reviews, the skill dispatches 'fresh-context subagents'—a platform capability that spawns independent agent instances—to evaluate the drafted specifications against a checklist before finalizing the output.
- [TIME_DELAYED_CONDITIONAL]: The validation logic for the 'Exit gate' includes a date-based trigger (targeting September 6, 2026, or later) that changes the requirements for specific template sections, such as 'Cost of not building it' and 'The cheapest alternative.'
Audit Metadata