spec-checklist

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use git status, git diff, git add, and git commit to manage documentation updates. This behavior is controlled by an AUTO_COMMIT flag and is intended for versioning the resolved specification points.
  • [PROMPT_INJECTION]: The skill parses content from various local markdown files (e.g., requirements/prd.md, design/design.md) which may contain untrusted data that could attempt to influence the agent's logic.
  • Ingestion points: Reads files within {FEATURE_DIR}/requirements, {FEATURE_DIR}/design, {FEATURE_DIR}/implementation, and {FEATURE_DIR}/verification (SKILL.md).
  • Boundary markers: No explicit boundary markers are defined for the document content being read.
  • Capability inventory: File read/write, git status, git diff, git add, and git commit (SKILL.md).
  • Sanitization: Includes a specific rule to avoid committing sensitive files like .env or credentials during the git process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 08:08 AM
Security Audit — agent-trust-hub — spec-checklist