speckit-constitution
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script located at .specify/scripts/bash/resolve-template.sh to resolve templates. This script is part of the project repository and is executed within the agent session.
- [DYNAMIC_EXECUTION]: The skill implements a hook system that reads from .specify/extensions.yml and automatically invokes commands as pre- and post-hooks. While the instructions attempt to scope these to internal project commands, the actual command string is derived from local configuration, representing a dynamic execution surface.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from various repository files and user input to generate project governance documents.
- Ingestion points: User $ARGUMENTS, project README, documentation files, and the existing constitution. It also reads hook command names and descriptions from .specify/extensions.yml.
- Boundary markers: The skill contains a Scope Guard section that instructs the model to classify governance versus non-governance intent, but it lacks technical delimiters or explicit ignore instructions for interpolated repository file content.
- Capability inventory: Capability to execute shell scripts, write to the file system (.specify/memory/constitution.md), and invoke project commands via the hook system.
- Sanitization: The skill relies on model-side classification logic rather than technical sanitization or validation of the ingested repository content.
Audit Metadata