speckit-taskstoissues

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local bash script located at .specify/scripts/bash/check-prerequisites.sh to verify the environment and extract task paths.
  • [COMMAND_EXECUTION]: Runs git config --get remote.origin.url to retrieve the repository's remote URL, which is used to ensure issues are created in the correct GitHub repository.
  • [DATA_EXPOSURE]: Accesses the content of tasks.md and repository metadata (git remote) to generate GitHub issues as part of its core functionality.
  • [PROMPT_INJECTION]: Processes untrusted data from local task files which serves as a surface for indirect prompt injection.
  • Ingestion points: Reads task definitions from specs/<feature>/tasks.md.
  • Boundary markers: Absent; the skill does not use specific delimiters to isolate task content from instructions.
  • Capability inventory: Includes shell script execution, git command execution, and GitHub CLI usage (gh issue create).
  • Sanitization: No explicit sanitization of task content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 06:53 AM
Security Audit — agent-trust-hub — speckit-taskstoissues