quick-spec
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it is designed to analyze arbitrary content from the local codebase to generate technical specifications.
- Ingestion points:
references/step-01-understand.md(Quick Orient Scan) andreferences/step-02-investigate.md(Read and Analyze Code). - Boundary markers: No explicit delimiters or isolation instructions are used when processing codebase content.
- Capability inventory: File system read/write access and local task invocation.
- Sanitization: No filtering or escaping of ingested codebase data is performed.
- [COMMAND_EXECUTION]: Step 4 of the workflow (
references/step-04-review.md) involves the invocation of a local adversarial review task located at{project-root}/_bmad/core/tasks/review-adversarial-general.xml. This is a structured use of internal task-chaining capabilities within the agent framework.
Audit Metadata