specsfy-milestone-governor
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
specsfyCLI tool (specsfy milestones sync --project .) to synchronize milestone data. This is a vendor-provided command intended for the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from local project files, including
specs.mdand files within thespecs/milestones/andspecs/backlog/directories. - Ingestion points: Files
specs.md,specs/milestones/, andspecs/backlog/referenced inSKILL.md. - Boundary markers: Not explicitly defined in the prompt instructions for these files.
- Capability inventory: Execution of
specsfy milestones synccommand. - Sanitization: Not specified, but the skill requires human confirmation before altering structural relations, which serves as a manual validation gate.
Audit Metadata