to-spec
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill's operations are transparent and align with its stated purpose of project documentation.
- [DATA_EXFILTRATION]: The skill transmits information to an external service (GitHub issues), but this is the primary intended function for the purpose of creating project specifications. The data is confined to the project's own issue tracker.
- [PROMPT_INJECTION]: The skill processes untrusted data from the codebase and conversation to generate output, which is a potential surface for indirect prompt injection. This is a common characteristic of summarization skills and is not indicative of malicious intent.
- Ingestion points: Codebase files and conversation context (SKILL.md).
- Boundary markers: Not explicitly defined in the specification template.
- Capability inventory: GitHub issue publication.
- Sanitization: Not explicitly specified in the instructions; relies on standard model behavior.
Audit Metadata