specsfy-aux-rules
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Node.js script (
scripts/add_rule.mjs) to update a local file (.specsfy/RULES.md). The command execution is restricted to this internal script using specific arguments (--project, --section, --rule) which is an expected and safe implementation for a configuration management skill. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill explicitly warns the agent in
SKILL.md: 'Não registrar segredo, token ou dado pessoal' (Do not register secrets, tokens, or personal data). This demonstrates a security-conscious design. - [INDIRECT_PROMPT_INJECTION]: The skill processes project documentation (
PROJECT.md,RULES.md) to infer rules. While these are external inputs, the risk is mitigated by the instruction to confirm rules via a 'Numbered Question Contract' and the fact that the script only appends rules to a specific file without executing them.
Audit Metadata