specsfy-04-validate
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download specialist modules from the vendor's repository (github.com/promovaweb/specsfy) using the
npx skills addcommand. - [REMOTE_CODE_EXECUTION]: Additional audit capabilities are integrated by fetching and executing specialist extensions from a remote repository, which is part of the tool's intended extensibility.
- [COMMAND_EXECUTION]: Audit scripts are executed locally to validate specifications, and the repository policy manager spawns sub-processes to run validation tools across the project.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-authored markdown specification files.
- Ingestion points:
spec.mdfiles are read by validation scripts from thespecs/directory. - Boundary markers: Strict structural requirements and specific markdown headings are used to delimit data fields.
- Capability inventory: Local file reading and spawning of Node.js sub-processes.
- Sanitization: Data parsing is restricted to regex-based structural checks and audits.
Audit Metadata