spec-writer
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a bundled JavaScript runtime located at
<plugin-root>/scripts/spec-superflow.mjsvia Node.js. This script is used to perform internal workflow management, such as retrieving change states and starting new workflow paths. The instructions specifically guide the agent to use the local script relative to the plugin root rather than a global binary. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local project environment to determine its workflow logic.
- Ingestion points: Project state and execution plans are read as JSON via the
SSF workflow showandSSF execution showcommands. Additionally, it reads documentation fromdocs/legacy-workflow.mdto handle older workflow versions. - Boundary markers: No specific delimiters or "ignore" instructions are provided to separate the system logic from the data ingested from these local files.
- Capability inventory: The skill can execute its own bundled Node.js script and has the authority to create or modify several markdown files (
proposal.md,tasks.md,specs/,design.md) based on the ingested state. - Sanitization: There is no evidence of sanitization or strict schema validation for the ingested artifacts or the user-provided reason during the
workflow startcommand.
Audit Metadata