specsfy-06-tdd-bdd
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests the installation of specialist extensions from the vendor's official GitHub repository (
github.com/promovaweb/specsfy). These downloads are handled through standard package management commands and target a known vendor source. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process specification files (
spec.md) which may contain untrusted data in collaborative environments. - Ingestion points: Specification files are read by the
check_traceability.mjsandverify_acceptance.mjsscripts to extract requirements and results. - Boundary markers: There are no explicit delimiters defined for the specification file content in the instructions.
- Capability inventory: The skill executes local audit scripts and suggests running project-specific test suites.
- Sanitization: Requirement extraction is performed using strict regular expression patterns for specific IDs (e.g., US/FR/AC), and evidence metadata is validated via JSON parsing, which mitigates the risk of executing arbitrary instructions embedded in the markdown.
Audit Metadata