spec-writer

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a bundled JavaScript runtime located at <plugin-root>/scripts/spec-superflow.mjs via Node.js. This script is used to perform internal workflow management, such as retrieving change states and starting new workflow paths. The instructions specifically guide the agent to use the local script relative to the plugin root rather than a global binary.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local project environment to determine its workflow logic.
  • Ingestion points: Project state and execution plans are read as JSON via the SSF workflow show and SSF execution show commands. Additionally, it reads documentation from docs/legacy-workflow.md to handle older workflow versions.
  • Boundary markers: No specific delimiters or "ignore" instructions are provided to separate the system logic from the data ingested from these local files.
  • Capability inventory: The skill can execute its own bundled Node.js script and has the authority to create or modify several markdown files (proposal.md, tasks.md, specs/, design.md) based on the ingested state.
  • Sanitization: There is no evidence of sanitization or strict schema validation for the ingested artifacts or the user-provided reason during the workflow start command.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 01:30 AM