specsfy-specialist-interface-experience
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local JavaScript files to perform project inspection and validate generated tasks or specifications. These scripts are located within the skill's own directory structure and are executed using the Node.js runtime.
- Evidence:
node .agents/skills/specsfy-setup/scripts/inspect_interface.mjs --project <raiz>inSKILL.md. - Evidence:
validate_spec.mjs,validate_tasks.mjs, andvalidate_interface_tasks.mjslisted under the validation flow inSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill identifies user interface components, technologies, and routing by parsing existing project code and manifests, which could potentially contain instructions that influence agent behavior.
- Ingestion points: The skill reads
.specsfy/STACK.md,.specsfy/PACKAGES.md, local manifests, and current project documentation. - Boundary markers: There are no explicit delimiters or boundary markers specified for the ingested file content.
- Capability inventory: The skill has the ability to execute local inspection scripts, generate UI specifications, and create development tasks.
- Sanitization: No explicit validation or sanitization of the ingested codebase or manifest data is mentioned before processing.
Audit Metadata