write-tech-spec
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is technical documentation and implementation planning, which are benign activities. It defines a clear structure for technical specs and enforces grounding in the actual codebase.
- [COMMAND_EXECUTION]: The skill mentions utilizing the 'gh' CLI and Linear MCP tools for ticket creation and issue management. These are established tools for the author's ecosystem and are used here within their intended scope for developer productivity.
- [PROMPT_INJECTION]: The skill processes data from the local codebase and 'PRODUCT.md' files, which constitutes a surface for indirect prompt injection. However, the risk is mitigated by the skill's specific focus on writing documentation and the lack of sensitive administrative capabilities. Evidence: 1. Ingestion points: local source code files and 'PRODUCT.md' files; 2. Boundary markers: none specified; 3. Capability inventory: file system writes to 'specs/' and 'gh' CLI operations; 4. Sanitization: none mentioned.
- [DATA_EXFILTRATION]: Analysis of the skill's instructions shows no evidence of unauthorized data exposure or exfiltration. Data accessed during research is used solely to generate internal project documentation.
Audit Metadata