roadmap-sync

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local JavaScript file via Node.js (spec-driven.js) to perform roadmap synchronization, initialization, and verification. These commands are constrained to the skill's own directory and the project's .spec-driven folder.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external files such as .spec-driven/roadmap/INDEX.md and various milestone files.
  • Ingestion points: Files located within the .spec-driven/roadmap/ directory and .spec-driven/config.yaml.
  • Boundary markers: None explicitly defined in the instructions for separating file content from instructions.
  • Capability inventory: The skill has the ability to read and write files within the project repository and execute a local Node.js script.
  • Sanitization: No specific sanitization or validation of the roadmap file content is described before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 04:44 PM