spec-driven-dev
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates a structured development process using project documentation files. It follows security best practices by requiring explicit user approval before implementation steps.
- [COMMAND_EXECUTION]: Instructs the agent to use
git addfor documentation files, which is a standard and expected development operation. - [EXTERNAL_DOWNLOADS]: Provides links to the vendor's official website and GitHub repository for resources related to the skill's primary purpose. These are documented as vendor-owned resources.
- [INDIRECT_PROMPT_INJECTION]: The skill reads specification files from the local filesystem to guide its behavior.
- Ingestion points: Markdown files within the
docs/specs/directory. - Boundary markers: The skill includes a clarification step (Step 3) and an ambiguity check (Step 2) to ensure requirements are clear.
- Capability inventory: Reading documentation and proposing/implementing code changes.
- Sanitization: The risk is mitigated by Step 6, which mandates waiting for explicit human approval of the implementation plan before any code implementation.
Audit Metadata