skills/ericrisco/rsc-harness/specify/Gen Agent Trust Hub

specify

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONTIME_DELAYED_CONDITIONAL
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run npm run spec:gate <path> to validate that the generated specification files meet the project's quality standards and template requirements.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user feature requests and reads project-specific documentation, such as 02-DOCS/wiki/harness/user-profile.md and 02-DOCS/wiki/sdd/constitution.md, to set context. While it uses a 'restate intent' pattern to align with the user, it lacks explicit sanitization for external content interpolated into the specifications.
  • [DYNAMIC_EXECUTION]: To avoid bias during reviews, the skill dispatches 'fresh-context subagents'—a platform capability that spawns independent agent instances—to evaluate the drafted specifications against a checklist before finalizing the output.
  • [TIME_DELAYED_CONDITIONAL]: The validation logic for the 'Exit gate' includes a date-based trigger (targeting September 6, 2026, or later) that changes the requirements for specific template sections, such as 'Cost of not building it' and 'The cheapest alternative.'
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 10:55 PM