talk-maple-ai-native-devcon-welcome-spec-reviewer
Use when the user asks about the AI Native DevCon talk "Welcome to AI Native DevCon" featuring Shachar from Buzz (hosted by Simon Maple, Head of DevRel at Tessl) — including questions about why code review is still a bottleneck in 2026, the Spec Reviewer agent architecture, splitting planner vs verifier agents, sub-agent delegation for requirements verification, context window explosion, why giving the agent the base branch beats the diff, ephemeral sandboxes with AWS Agent Core, context engineering for complex agentic tasks, or how to find product gaps the big coding agents overlook.
65
80%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Fix and improve this skill with Tessl
tessl review fix ./talk-maple-ai-native-devcon-welcome-spec-reviewer/SKILL.mdThe canonical home for this skill is ainativedev/aidevcon-2026-ldn
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt repeatedly requires the agent to "quote verbatim" from transcript.md (and to embed those verbatim quotes into answers), which could force the model to reproduce any secret tokens or credentials present in that file, creating an exfiltration risk.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow described in the talk (“Spec Reviewer” verifier) actively navigates through an application/UI and uses an ephemeral sandbox to validate requirements by clicking/browsing customer-provided “unknown URLs,” meaning outsider-authored free text can reach the LLM via the visited page contents at runtime.
- Repository
- AINativeDev/aidevcon-2026-ldn
- Commit
1887349
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.