roadmap-sync
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local JavaScript file via Node.js (
spec-driven.js) to perform roadmap synchronization, initialization, and verification. These commands are constrained to the skill's own directory and the project's.spec-drivenfolder. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external files such as
.spec-driven/roadmap/INDEX.mdand various milestone files. - Ingestion points: Files located within the
.spec-driven/roadmap/directory and.spec-driven/config.yaml. - Boundary markers: None explicitly defined in the instructions for separating file content from instructions.
- Capability inventory: The skill has the ability to read and write files within the project repository and execute a local Node.js script.
- Sanitization: No specific sanitization or validation of the roadmap file content is described before processing.
Audit Metadata