tlc-spec-driven
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user feature requests and ambiguity discussions to generate structured specifications, architectural designs, and atomic task lists. These artifacts directly influence subsequent automated code implementation and the execution of tests and validation scripts. While the skill enforces structural gates using EARS notation and atomic task definitions, it does not apply explicit sanitization or delimitation to raw user input before interpolation into these project artifacts.
- Ingestion points: User-supplied requirements in the 'Specify' and 'Discuss' phases are used to populate
spec.mdandcontext.mdfiles. - Capability inventory: The skill possesses read/write file access and the ability to execute subprocesses (tests, linting, and internal Python scripts) via the terminal.
- Sanitization: No explicit filtering of user-supplied text is performed during the requirement capture process.
- [DYNAMIC_EXECUTION]: The skill incorporates a 'discrimination sensor' mechanism for feature-level validation, as detailed in the validation and sub-agent documentation. This process involves the dynamic creation of code mutations to verify test efficacy.
- Evidence: The instructions require the agent to inject behavior-level faults (e.g., flipping boolean logic or changing return values) into an isolated scratch worktree and then execute the test suite against this modified code to ensure the mutants are 'killed'.
- [COMMAND_EXECUTION]: The skill relies on the execution of multiple command-line tools to perform its intended functions. This includes the use of
gitfor worktree management and commit validation,python3for running local validation and bookkeeping scripts (such asscripts/validate_spec.pyandscripts/lessons.py), and standard system utilities for file operations likelnandchmodwhen setting up project git hooks.
Audit Metadata