speckit-initial
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external project configuration files, including 'memory' and 'specs', into the agent's environment. These files serve as context for agent behavior and slash commands.
- Ingestion points: Files pulled into the '.specify/' directory during initialization.
- Boundary markers: No explicit delimiters or safety instructions are provided for the pulled content.
- Capability inventory: The skill registers slash commands ('/speckit.*') that execute scripts within the '.specify/' directory.
- Sanitization: No sanitization or validation of the pulled content is described.
- [COMMAND_EXECUTION]: The skill executes the 'specify init' command to bootstrap the project environment.
- [EXTERNAL_DOWNLOADS]: The initialization process pulls resources from the Spec Kit repository on GitHub, which is a well-known service provider.
Audit Metadata