specforge-implement
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local JavaScript utility scripts located at
.specforge/tools/instructions.mjsand.specforge/tools/create-artifact.mjsusing the Node.js runtime. - [INDIRECT_PROMPT_INJECTION]: The skill processes implementation instructions from the
01-spec/tasks.mdfile, which could theoretically contain malicious prompts intended to influence the agent's output or actions. - Ingestion points:
01-spec/tasks.md(read via file system). - Boundary markers: None; instructions are followed sequentially as defined in the task file.
- Capability inventory: File system write/edit access and local shell command execution via Node.js.
- Sanitization: No explicit sanitization or validation of task content is performed before execution.
Audit Metadata