speckit
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill is a legitimate documentation and planning tool designed to help developers structure their projects.
- [COMMAND_EXECUTION]: The skill includes two Python scripts:
scripts/init_spec_dir.pyandscripts/validate_spec.py. Analysis shows these scripts use standard libraries (pathlib,argparse,re) to manage local feature directories and perform basic validation of Markdown files. No unsafe shell command execution or user-controlled string evaluation was found. - [EXTERNAL_DOWNLOADS]: The skill does not perform any network operations or download external content. All templates and reference documents are provided within the skill package.
- [DATA_EXFILTRATION]: No patterns indicative of data exfiltration were found. The skill only interacts with local files in the specified project directory (typically a
specs/folder). - [PROMPT_INJECTION]: The skill provides structured templates and instructions for the agent to follow. While it processes natural language feature descriptions, it does so to generate static documentation, presenting no significant surface for behavioral override or safety bypass.
Audit Metadata