speckit-taskstoissues
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script located at
.specify/scripts/bash/check-prerequisites.shto verify the environment and extract task paths. - [COMMAND_EXECUTION]: Runs
git config --get remote.origin.urlto retrieve the repository's remote URL, which is used to ensure issues are created in the correct GitHub repository. - [DATA_EXPOSURE]: Accesses the content of
tasks.mdand repository metadata (git remote) to generate GitHub issues as part of its core functionality. - [PROMPT_INJECTION]: Processes untrusted data from local task files which serves as a surface for indirect prompt injection.
- Ingestion points: Reads task definitions from
specs/<feature>/tasks.md. - Boundary markers: Absent; the skill does not use specific delimiters to isolate task content from instructions.
- Capability inventory: Includes shell script execution, git command execution, and GitHub CLI usage (
gh issue create). - Sanitization: No explicit sanitization of task content is performed before processing.
Audit Metadata