constructive-blueprints
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests complex JSON blueprint definitions that drive database provisioning, representing a potential surface for indirect injection.
- Ingestion points: The definition JSONB field in SKILL.md and references/blueprint-definition-format.md.
- Boundary markers: Absent.
- Capability inventory: Database operations including table and policy creation via construct_blueprint() and copy_template_to_blueprint().
- Sanitization: The documentation specifies that authorization is enforced through Row-Level Security (RLS) policies and backend validation rules.
- [DYNAMIC_EXECUTION]: The skill compiles declarative JSON definitions into active SQL database objects including tables, relations, and triggers at runtime using the Constructive provisioning engine.
- [SAFE]: No evidence of malicious behavior, data exfiltration, unauthorized command execution, or obfuscation was found during the analysis. All referenced resources are within the constructive-io vendor ecosystem.
Audit Metadata