specsfy-update-spec
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a local Node.js script (
analyze_change.mjs) to compare specification versions and project the impact of changes. The script securely invokesgitcommands usingspawnSyncwith argument arrays to prevent command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user requests and existing project files (
spec.md). While there are no explicit delimiters to isolate this data, the context is limited to document editing and workflow orchestration, posing a low risk of malicious instruction execution.
Audit Metadata