write-specs

• Outcome: Review
• Latest audit: Sep 12, 2026 · 10:51 PM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent SPEC-writing workflow, but its template can cause downstream agents to open pull requests automatically, so users should review and constrain it before use.

Use this skill only if you are comfortable with a pt-BR requirements workflow and repository fact gathering. Before using any SPEC it produces for implementation, remove or override the automatic PR-opening instructions and require an explicit final approval before any branch, PR, or remote repository action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill hard-requires Portuguese for all user-facing questions regardless of the user's preferred language or explicit consent. This can mislead users, degrade informed consent, and cause important requirement, security, or approval details to be misunderstood during a high-dependency specification workflow.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **No guessing.** If a fact is missing, ask the user. If the user declines, mark it `[A DEFINIR]` in the SPEC.
2. **No implementation.** Never write implementation code. The output is the SPEC only.
3. **Shared understanding first.** The session ends only when the design-tree frontier is empty.
4. **Evidence-based.** Look up repository, docs, and code facts with sub-agents. Do not ask the user for things you can find yourself.

## The Design Tree

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Fact Gathering

Finding facts is the agent's job, never the user's. When a frontier question needs a fact from the environment (file system, tools, docs, code), dispatch a sub-agent to find it. Do not ask the user for anything you could look up yourself. Do not block: a running exploration is an unsettled prerequisite, so only the questions downstream of it wait for the sub-agent to report; ask the rest of the frontier now.

## Writing the SPEC SDD

• Confidence: 80% confidence
• Finding: The skill directs the agent to dispatch sub-agents and continue parallel fact gathering without explicit user confirmation for each exploration step. In an agentic environment, this can expand autonomous access to files, docs, and tools beyond the user's expectations, increasing the risk of unintended data exposure, overreach, or unreviewed actions.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template instructs the agent to immediately open a PR once the Definition of Done is complete, without an explicit final user confirmation gate. In an autonomous agent workflow, this can cause unauthorized or premature code publication, especially if the implementation is incomplete, policy-noncompliant, or produced from a misunderstood spec.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The agent loop reinforces mandatory automatic PR creation as a required step after marking the work done, again omitting a user opt-in or governance review checkpoint. Repetition increases the chance an implementation agent will treat PR creation as compulsory behavior, leading to unintended repository actions.

Scope Creep

Low

• Category: Excessive Agency

Content

- **Registries:** use only approved corporate/organization registries — never public registries unless explicitly authorized.
- **API headers:** use the organization's standard correlation / authentication headers as defined by the API governance team.
- **Security:** do not log PII/tokens/identifiers; store secrets via the organization's secret manager; no `.env` in commit.
- **Scope:** do not invent requirements or expand scope. Stop and ask on ambiguity.
- **Architecture:** no business logic in controllers/components; domain does not access infrastructure.

## 9. Definition of Done

• Confidence: 75% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.