app-spec-packager
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/create_spec_package.py) to scaffold directory structures and initial Markdown templates. Analysis of the script shows it uses only standard library modules (argparse, pathlib, zipfile, etc.) to perform file system operations and does not execute external or untrusted code. - [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves processing user-supplied application ideas. While this represents an ingestion of untrusted data, the skill's output is restricted to static documentation (Markdown and ZIP files). The instructions include specific guidelines for handling sensitive data and maintain a posture of least privilege by recommending data minimization.
- [SAFE]: The skill incorporates extensive security and privacy references (
references/safety-privacy.md). It explicitly instructs the AI agent to avoid hardcoding secrets, minimize PII in logs/analytics, and implement server-side authorization, demonstrating a strong secure-by-default design philosophy.
Audit Metadata