cmd-speckit-converge
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a 'hooks' system that parses
.specify/extensions.ymland automatically executes the value of thecommandkey using theEXECUTE_COMMANDdirective. Evidence: Found in 'Pre-Execution Checks' and 'Check for extension hooks' sections where the agent is instructed to invoke hook commands. - [COMMAND_EXECUTION]: The skill executes local shell and PowerShell scripts defined in the frontmatter as part of its prerequisite checks. Evidence: frontmatter 'scripts' key referencing bash and powershell scripts.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it loads and acts upon instructions from multiple untrusted project files without sanitization. 1. Ingestion points: spec.md, plan.md, tasks.md, /memory/constitution.md, and .specify/extensions.yml. 2. Boundary markers: Absent; the skill lacks delimiters or instructions to ignore embedded commands in these files. 3. Capability inventory: Arbitrary shell command execution via hooks and file system writes to tasks.md. 4. Sanitization: None; the skill directly incorporates content from these artifacts into its logic.
Audit Metadata