specsfy-data-discovery
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted project data and user input to generate documentation.
- Ingestion points: Project files such as
MVP.md,PROJECT.md,Inbox, and user-provided conversation inputs. - Boundary markers: The skill contains explicit instructions to separate confirmed data from observations and has a 'Limits' section that forbids filling gaps by inference.
- Capability inventory: File system write operations are performed via the included
registrar_dados_conversados.mjsscript. - Sanitization: The recording script sanitizes input strings by escaping markdown pipe characters (
|) and removing newlines to ensure the integrity of the generated markdown table. - [COMMAND_EXECUTION]: The skill utilizes a local Node.js script to automate the recording of discovered data.
- The script (
registrar_dados_conversados.mjs) is provided as part of the skill and relies solely on Node.js built-in modules (node:fs,node:path,node:promises). - No external network requests or third-party package dependencies are present in the script code.
Audit Metadata