speckit-baseline
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code to generate documentation, which is a standard vector for indirect prompt injection.
- Ingestion points: Source code files and local configuration files within the
.specify/directory (SKILL.md). - Boundary markers: No explicit delimiters are specified to isolate the input code from the agent's reasoning instructions.
- Capability inventory: The skill is permitted to read local files and write markdown documentation to the
specs/directory. - Sanitization: The skill includes strong mitigations by instructing the agent to ignore code comments and naming patterns when determining behavior, focusing exclusively on observable execution logic. This prevents the agent from following instructions embedded in comments.
- [EXTERNAL_DOWNLOADS]: Mentions the GitHub Spec Kit repository for structural conventions. This is an informational reference to an official repository from a well-known service provider.
Audit Metadata