speckit-init

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of the specify CLI tool to scaffold project files. It provides specific command patterns (e.g., specify init <project-name> --integration copilot) to be run in the user's terminal environment (bash, powershell, or python shell).
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided project name or directory path as a command-line argument for the specify init command. This represents a potential injection surface if the user provides malicious arguments, though this is a standard pattern for scaffolding tools and is considered low risk in this context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 11:49 PM
Security Audit — agent-trust-hub — speckit-init