speckit-constitution

Warn

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local shell script located at .specify/scripts/bash/resolve-template.sh to resolve templates. This script is part of the project repository and is executed within the agent session.
  • [DYNAMIC_EXECUTION]: The skill implements a hook system that reads from .specify/extensions.yml and automatically invokes commands as pre- and post-hooks. While the instructions attempt to scope these to internal project commands, the actual command string is derived from local configuration, representing a dynamic execution surface.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from various repository files and user input to generate project governance documents.
  • Ingestion points: User $ARGUMENTS, project README, documentation files, and the existing constitution. It also reads hook command names and descriptions from .specify/extensions.yml.
  • Boundary markers: The skill contains a Scope Guard section that instructs the model to classify governance versus non-governance intent, but it lacks technical delimiters or explicit ignore instructions for interpolated repository file content.
  • Capability inventory: Capability to execute shell scripts, write to the file system (.specify/memory/constitution.md), and invoke project commands via the hook system.
  • Sanitization: The skill relies on model-side classification logic rather than technical sanitization or validation of the ingested repository content.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 18, 2026, 01:11 PM