apm-spec-guardian

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONNO_CODE
Full Analysis
  • Mechanical Linter Execution: The skill uses a set of Bash and Python one-liners in assets/linter-checklist.md to verify the integrity of specification files. These checks include ASCII-only validation, searching for forbidden tokens, JSON schema parsing, and anchor uniqueness verification. While these involve command execution, they are scoped to local files and use standard tools for static analysis.
  • Advisory Regime: A core design principle of the skill is that it is advisory. It specifically prohibits the use of binary verdicts (APPROVE/REJECT) or merge gating. The results are presented as a single consolidated comment for a human maintainer to review, which reduces the risk of unauthorized or automated changes to the repository state.
  • Persona-Based Task Fan-out: The skill orchestrates multiple sub-agents (Swagger Editor, OCI Editor, etc.) using the task tool. Each sub-agent is instructed to return structured JSON and is explicitly forbidden from performing write operations on the PR state, such as adding labels or comments.
  • Data Ingestion and Sanitization: The skill processes PR diffs and specification artifacts. It enforces a strict 'ASCII-only' rule (U+0020
  • U+007E) for all output and artifact content to prevent encoding-based obfuscation or the inclusion of unexpected characters. It also implements a 'no-vendor-foundation' rule to filter specific organizational names from the normative text.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 09:56 PM