Skip to content
Report library
Purpose / Development

Implement Spec Skill Security Audit

What the author says it does (original text)

Implement a specification in code.

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

An exploration agent may leave repository or specification material outside the repo for future agents

Source references: 1
What we found

The optional exploration step explicitly requires Markdown notes outside the repository and makes them accessible to all future subagents. It sets no limits on note contents, location, retention, or cleanup.

Why this matters

If notes contain private code excerpts, internal architecture, issue contents, or other sensitive context, they create a persistent copy outside repository access controls and normal cleanup, with access broadened to later agents.

This is optional but actionable: an exploration agent may inspect repository files or external documentation and is told to save Markdown notes outside the repository for all future subagents. If those notes contain private code, specifications, or credential fragments, the unspecified location, audience, and retention period could broaden exposure. The text does not prove sensitive data will be written; users can require a bounded temporary directory, secret exclusion, task-only access, and cleanup.

SKILL.md:21In the instructionsOpen original file
2. (optional) Use an **exploration subagent** to conduct any exploration required by the tickets - relevant codebase files or external documentation. Ensure the exploration subagent can save files - it should save its markdown notes in a directory outside the repo, accessible by all future subagents. This lets **implementer subagents** focus on implementation rather than exploration.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Automatic cleanup of all implementation worktrees may remove work that was not preserved

Source references: 3
What we found

The final step requires cleaning up every implementation worktree, but it does not require checking for uncommitted, untracked, or unsuccessfully merged files first, nor does it restrict cleanup to non-forced removal.

Why this matters

If a worktree still contains unique uncommitted or unmerged changes, forced cleanup could make those files or changes difficult to recover.

What this evidence establishes

The instructions do require eventual cleanup of implementer worktrees, but they do not specify forced removal or direct deletion of uncommitted or untracked files. Cleanup occurs after agent work is merged and all tickets and review fixes are complete, so the claimed data loss is not directly required by the text; however, no clean-state or successful-merge check is stated. Users can ask the author to limit cleanup to merged worktrees with no uncommitted changes.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:27In the instructionsOpen original file
5. Once an **implementer subagent** completes, merge its work to the PR branch with a **merger subagent**.
Show 2 other places
SKILL.md:35In the instructionsOpen original file
9. Clean up all **implementer subagent** worktrees.
SKILL.md:31In the instructionsOpen original file
7. Once all tickets are complete, run /code-review on the PR branch. Fix all issues raised by the code review in a single **implementer subagent**.
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The workflow can create a PR, attach issue-closing directives, and mark it ready without a user approval gate

Source references: 3
What we found

The instructions require creating a branch and draft PR, marking it as closing the specification issue and tickets, and later making it ready for review. They do not require user confirmation before these remote repository actions.

Why this matters

With repository access, the agent changes shared workflow state. Closing keywords may automatically close several issues when the PR merges, while ready status may trigger reviewer notifications or automation.

The live workflow requires creating a branch and draft PR, associating it with closure of the spec issue and tickets, and finally marking it ready for review. These steps change repository and issue state in an external hosting account, and the visible instructions contain no user-confirmation gate. This is expected only when the user has authorized the full PR workflow; users can ask for confirmation or permission limits before PR creation, closure links, and ready status.

SKILL.md:23In the instructionsOpen original file
3. Create a branch, and a draft PR. The PR should be marked as 'closing' the spec issue and tickets.
Show 2 other places
SKILL.md:33In the instructionsOpen original file
8. Mark the PR as ready for review.
SKILL.md:9In the instructionsOpen original file
The goal is a PR which implements the entire spec on a single branch.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

The Skill disables implicit model invocation; a user must select it explicitly, after which its stated goal is to implement the entire specification in one PR.

View source
SKILL.md:4In the instructionsOpen original file
description: "Implement a specification in code."disable-model-invocation: true---
SKILL.md:9In the instructionsOpen original file
The goal is a PR which implements the entire spec on a single branch.
agents/openai.yaml:5In the instructionsOpen original file
policy:  allow_implicit_invocation: false

The workflow treats tickets as a dependency graph and continually assigns currently unblocked tickets to background implementation agents for concurrency.

View source
SKILL.md:11In the instructionsOpen original file
The tickets are not a list of steps. They are a **task graph** with blocking relationships between them. This means there is always a **frontier** of tickets which are ready to be grabbed.
SKILL.md:15In the instructionsOpen original file
**Implementer subagents** should be run in the background where possible for **maximum concurrency**.
SKILL.md:29In the instructionsOpen original file
6. If this changes the **frontier** of available tickets, kick off more **implementer subagents** to work on the new tickets. This allows for maximum concurrency.

Each implementation agent works in a separate branch and worktree, another agent merges completed work, and a final code review is followed by one agent fixing every reported issue.

View source
SKILL.md:25In the instructionsOpen original file
4. Use **implementer subagents** to implement each ticket. Each implementer subagent should work in its own worktree, on its own branch.
SKILL.md:27In the instructionsOpen original file
5. Once an **implementer subagent** completes, merge its work to the PR branch with a **merger subagent**.
SKILL.md:31In the instructionsOpen original file
7. Once all tickets are complete, run /code-review on the PR branch. Fix all issues raised by the code review in a single **implementer subagent**.

The workflow intentionally minimizes agent-to-agent communication and relies mainly on pointers to specifications, tickets, research notes, and commits.

View source
SKILL.md:13In the instructionsOpen original file
Communication to and from subagents should be sparse. Communicate primarily through **context pointers**: to the spec, tickets, research notes, and previous commits. Don't duplicate information already available via pointers.
Start here · InstructionsSKILL.md
implement-spec
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
42
File checksum (to compare versions)
51cab858ca9a9219a426e67cfbd243e6a3c12b67c873cb02a88a3fbe1e68496d