Security Audit
dceoy/speckit-agent-skills:skills/speckit-specify
github.com/dceoy/speckit-agent-skillsTrust Assessment
dceoy/speckit-agent-skills:skills/speckit-specify received a trust score of 65/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 2 findings: 1 critical, 1 high, 0 medium, and 0 low severity. Key findings include Command Injection via unvalidated script arguments, Arbitrary File Write due to unvalidated paths from script output.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 55/100, indicating areas for improvement.
Last analyzed on April 1, 2026 (commit a934d48e). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Command Injection via unvalidated script arguments The skill executes the script `.specify/scripts/bash/create-new-feature.sh` with arguments derived from LLM-generated `short-name` and `feature description`. The instructions explicitly note the complexity of handling quotes (e.g., `I'\''m Groot`), indicating that the LLM is responsible for proper shell escaping. If the LLM fails to correctly escape or quote malicious input in the `short-name` or `feature description`, an attacker could inject arbitrary shell commands, leading to unauthorized execution of code on the host system. All LLM-generated inputs passed to shell commands must be strictly sanitized or properly escaped using a robust, language-specific shell escaping library (e.g., `shlex.quote` in Python) before execution. Do not rely on the LLM to perform correct escaping. Additionally, the `create-new-feature.sh` script itself should implement robust input validation and sanitization for all its arguments. | LLM | SKILL.md:50 | |
| HIGH | Arbitrary File Write due to unvalidated paths from script output The skill writes generated content to `specs/<feature>/spec.md` and `FEATURE_DIR/checklists/requirements.md`. The `SPEC_FILE` and `FEATURE_DIR` paths are determined by the JSON output of the `create-new-feature.sh` script, which takes LLM-generated input. If the `short-name` or `feature description` (which are LLM-generated) can be manipulated to include path traversal sequences (e.g., `../../`) and the `create-new-feature.sh` script does not adequately sanitize or validate these inputs before constructing file paths, an attacker could cause the agent to write to arbitrary locations on the filesystem. This could lead to data corruption, denial of service, or the creation of malicious files. The `create-new-feature.sh` script must strictly validate and sanitize all inputs used to construct file paths, disallowing path traversal sequences (e.g., `..`, `/`) and ensuring paths are confined to expected directories. The agent should also validate the `BRANCH_NAME` and `SPEC_FILE` paths returned by the script before performing any file write operations, ensuring they are within the designated and safe working directory. | LLM | SKILL.md:140 |
Scan History
Embed Code
[](https://skillshield.io/report/8ec5a374b138f73a)
Powered by SkillShield