speckit-constitution-zh

The script is primarily a legitimate repository-maintenance utility and contains no clear malware, data exfiltration, persistence, or destructive behavior. It does contain a significant command-injection risk through eval $(get_feature_paths) if common.sh output is attacker-influenced, plus lower-severity sed injection and file-content integrity risks from incomplete escaping of plan and path-derived values. Review common.sh and replace eval with safe variable assignment or a non-evaluating interface before trusting the script in untrusted repositories.