claude-spec-interviewer
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure planning lifecycle that distinguishes between 'Plan Mode' (read-only discovery) and 'Implementation Mode' (artifact persistence). This prevents accidental or unauthorized modification of the workspace during the discovery phase.
- [DATA_EXPOSURE]: The skill is designed to inspect repository context such as documentation, project rules, and file layouts to inform implementation plans. It includes specific safety rules prohibiting the inclusion of secrets, credentials, or private identifiers in the resulting artifacts.
- [PROMPT_INJECTION]: The instructions contain defensive constraints requiring the agent to state assumptions explicitly, avoid inventing repository facts, and challenge user requirements against the actual source code and repository instructions (e.g., AGENTS.md, CLAUDE.md).
- [COMMAND_EXECUTION]: The skill references validation commands (e.g., linting, testing, type-checking) within its templates. These are intended for the user's local development environment to verify the implementation plan and do not represent malicious command execution or shell injection patterns within the skill itself.
- [SAFE]: The skill incorporates a 'Source Challenge' and 'ADR Gate' workflow to ensure that architectural decisions are durable, source-backed, and verified by the user, reducing the risk of indirect prompt influence from stale or malicious documentation.
Audit Metadata