speckit-clarify

Warn

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is instructed to execute a local shell script at .specify/scripts/bash/check-prerequisites.sh to obtain project paths and configuration details.
  • [COMMAND_EXECUTION]: The skill implements a dynamic hook system that reads .specify/extensions.yml and executes commands defined in the hooks.before_clarify and hooks.after_clarify sections. This allows for the execution of arbitrary commands based on strings provided in project-level configuration files.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its reliance on multiple unsanitized external files from the project repository.
  • Ingestion points: Reads and processes .specify/extensions.yml, .specify/memory/constitution.md, the feature specification file, and FEATURE_DIR/checklists/requirements.md.
  • Boundary markers: Absent. The agent is directed to treat the contents of these files as authoritative instructions or context without delimiters.
  • Capability inventory: The skill can execute local scripts, invoke dynamic hook commands, and perform writes to the local file system.
  • Sanitization: No filtering, escaping, or validation logic is specified for the content ingested from the external project files.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 30, 2026, 09:10 PM
Security Audit — agent-trust-hub — speckit-clarify