CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

18.2 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 4 flagged

Securityscore 52 · 4 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/agents/speckit.checklist.agent.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerpt.github/agents/speckit.checklist.agent.md· markdown

60- If presenting options, generate a compact table with columns: Option | Candidate | Why It

… (7 chars elided on L60)

61- Limit to A–E options maximum; omit table if a free-form answer is clearer

62- Never ask the user to restate what they already said

63- Avoid speculative categories (no hallucination). If uncertain, ask explicitly: "Confirm wh

… (26 chars elided on L63)

Occurrences

1 occurrence · at L62

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · .github/agents/speckit.specify.agent.md×2

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The exact value spotted

excerpt.github/agents/speckit.specify.agent.md· markdown

21## Outline

23The text the user typed after `/speckit.specify` in the triggering message **is** the featur

… (108 chars elided on L23)

25Given that feature description, do this:

Occurrences

2 occurrences · first at L23, also L205

Show all 2 locations

Line

File

L23

.github/agents/speckit.specify.agent.md

L205

.github/agents/speckit.specify.agent.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · .github/agents/speckit.clarify.agent.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerpt.github/agents/speckit.clarify.agent.md· markdown

130- User signals completion ("done", "good", "no more"), OR

131- You reach 5 asked questions.

132- Never reveal future queued questions in advance.

133- If no valid questions exist at start, immediately report no critical ambiguities.

134

Occurrences

1 occurrence · at L132

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha25631af9ccee29e8511…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/speckit-plan/SKILL.md · 1 file

skills/speckit-plan/SKILL.md3.5 KB · Markdown

name: speckit-plan

description: Execute the implementation planning workflow using the plan template to generate design artifacts.

Spec Kit Plan Skill

When to Use

The feature spec is ready and you need a technical implementation plan.

Inputs

specs/<feature>/spec.md
Repo context and .specify/ templates
User-provided constraints or tech preferences (if any)

If the spec is missing, ask the user to run speckit-specify first.

Workflow

Setup: Run .specify/scripts/bash/setup-plan.sh --json from repo root and parse JSON for FEATURE_SPEC, IMPL_PLAN, SPECS_DIR, BRANCH. For single quotes in args like "I'm Groot", use escape syntax: e.g 'I'\''m Groot' (or double-quote if possible: "I'm Groot").

Load context: Read FEATURE_SPEC and .specify/memory/constitution.md. Load IMPL_PLAN template (already copied).

Execute plan workflow: Follow the structure in IMPL_PLAN template to:

Fill Technical Context (mark unknowns as "NEEDS CLARIFICATION")
Fill Constitution Check section from constitution
Evaluate gates (ERROR if violations unjustified)
Phase 0: Generate research.md (resolve all NEEDS CLARIFICATION)
Phase 1: Generate data-model.md, contracts/, quickstart.md
Phase 1: Update agent context by running the agent script
Re-evaluate Constitution Check post-design

Stop and report: Command ends after Phase 2 planning. Report branch, IMPL_PLAN path, and generated artifacts.

Phases

Phase 0: Outline & Research

Extract unknowns from Technical Context above:

For each NEEDS CLARIFICATION → research task
For each dependency → best practices task
For each integration → patterns task

Generate and dispatch research agents:

   For each unknown in Technical Context:
     Task: "Research {unknown} for {feature context}"
   For each technology choice:
     Task: "Find best practices for {tech} in {domain}"

Consolidate findings in research.md using format:

Decision: [what was chosen]
Rationale: [why chosen]
Alternatives considered: [what else evaluated]

Output: research.md with all NEEDS CLARIFICATION resolved

Phase 1: Design & Contracts

Prerequisites: research.md complete

Extract entities from feature spec → data-model.md:

Entity name, fields, relationships
Validation rules from requirements
State transitions if applicable

Generate API contracts from functional requirements:

For each user action → endpoint
Use standard REST/GraphQL patterns
Output OpenAPI/GraphQL schema to /contracts/

Agent context update:

Run .specify/scripts/bash/update-agent-context.sh <agent_type>
Use the current runtime agent type (e.g., claude, codex, copilot, gemini). Leave empty to update all existing agent files.
Update the appropriate agent-specific context file
Add only new technology from current plan
Preserve manual additions between markers

Output: data-model.md, /contracts/\*, quickstart.md, agent-specific file

Key rules

Use absolute paths
ERROR on gate failures or unresolved clarifications

Outputs

specs/<feature>/plan.md (filled implementation plan)
specs/<feature>/research.md
specs/<feature>/data-model.md
specs/<feature>/contracts/ (API schemas)
specs/<feature>/quickstart.md
Updated agent context file (runtime-specific)

Next Steps

After planning:

Generate tasks with speckit-tasks.
Create a checklist with speckit-checklist when a quality gate is needed.

speckit-plan— agent skill

Is speckit-plan safe to install?

Spec Kit Plan Skill

When to Use

Inputs

Workflow

Phases

Phase 0: Outline & Research

Phase 1: Design & Contracts

Key rules

Outputs

Next Steps

Audit the pieces. Scan the whole. Decide.