Spec Kit — agentic threat model
Spec Kit introduces moderate-to-high risk as a developer-facing orchestration toolkit that coordinates powerful coding agents; while its structured Markdown-based workflow enhances transparency, a compromise in the template generation or underlying agent integration could lead to malicious code injection and supply chain vulnerabilities.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.80 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.60 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.70 | |
| Dynamic Identity | 0.20 | |
| Multi-Agent Interactions | 0.70 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — Spec Kit is an open-source toolkit and CLI that orchestrates external AI coding agents (like Claude Code) rather than hosting its own foundation models. Model-level threats like adversarial reprogramming or data poisoning depend entirely on the 30+ third-party models it supports.
Not certain from the listing — The tool generates local Markdown artifacts (Spec, Plan, Tasks, Implement) and performs cross-artifact analysis, but details regarding vector databases, long-term data storage, or data exfiltration protections are not specified.
Spec Kit provides a structured orchestration framework using slash commands (/specify, /plan, /tasks, /implement) and templates. The primary framework threat is prompt injection or template poisoning, where malicious inputs could manipulate the generated tasks or implementation instructions to execute unauthorized commands via the underlying coding agent.
Not certain from the listing — As a CLI tool (Specify CLI), it runs locally or within developer CI/CD environments. The security of the hosting infrastructure, sandboxing of code execution, and secret management depend on the user's local environment and the specific coding agent's runtime configuration.
Spec Kit includes quality checklists and cross-artifact analysis to evaluate the consistency of generated specifications and plans. However, it lacks built-in runtime security monitoring, anomaly detection, or guardrails to prevent the generation of insecure code during the implementation phase.
Not certain from the listing — Being an open-source CLI toolkit, there is no mention of built-in identity management, access control policies, or compliance auditing, relying instead on the permissions of the host system and the underlying agent's API keys.
Spec Kit explicitly supports and coordinates with 30+ AI coding agents. This multi-agent ecosystem introduces risks of cascading failures or trust abuse, where a vulnerability or compromise in one supported agent could propagate through the SDD workflow and compromise the entire codebase.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).