spec-driven
Warn
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow files
BrainDump.md,SpecInterview.md, andGenerateSpec.mdtriggercurlcommands to send POST requests tohttp://localhost:8888/notify. This interaction with the local network environment occurs without verification. - [COMMAND_EXECUTION]: In
GenerateSpec.md, the skill generates shell commands for directory creation and file management using interpolated user-controlled variables like[title]. Processing these within subshells and pipes creates a risk of command injection. - [DATA_EXFILTRATION]: The skill reads from and writes to
$HOME/.claude/MEMORY/WORK/. Accessing the user's home directory is a sensitive operation that can lead to the exposure of private directory structures. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Ingestion points: Raw user 'brain dump' input. Boundary markers: None. Capability inventory: File-write operations, shell command execution, and local network requests. Sanitization: None. An attacker could inject malicious instructions into the initial dump that are subsequently incorporated into the 'Verification Commands' section of the finalized specification, which is intended to be executed.
Audit Metadata