spec-driven-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructional markdown files that define a structured development lifecycle. It does not contain executable code, scripts, or obfuscated content. All external links point to established technology documentation (e.g., Cursor, Anthropic, GitHub) or relevant developer resources (e.g., Martin Fowler, skills.sh).
- [COMMAND_EXECUTION]: The instructions direct the agent to run project-specific verification commands via the
project-cmdsconvention. This is a standard platform feature allowing the agent to run local tests and linters defined by the user in the target repository. The skill does not inject its own commands into this process. - [INDIRECT_PROMPT_INJECTION]: The workflow involves the agent reading user requirements and existing codebase context to generate specifications. This is the primary attack surface. The skill mitigates this by emphasizing human review gates, assumption surfacing, and separate evaluation phases (generator ≠ evaluator).
- [EXTERNAL_DOWNLOADS]: The
getting-started.mdfile mentions installation vianpx skills add rhyanvargas/agentic-development-starter-kit. This is a reference to the author's own resource and represents the standard deployment method for this toolkit within its ecosystem.
Audit Metadata