project-governance
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a local validation script (scripts/validate-governance.mjs) to be executed via Node.js for structural validation of governance documents. This command checks for duplicate requirement IDs and broken local Markdown links within a specified directory.
- [PROMPT_INJECTION]: The skill is designed to process external project documentation, creating an attack surface for indirect prompt injection.
- Ingestion points: Reads repository instructions and existing documentation (SKILL.md).
- Boundary markers: Explicit instructions to establish context, preserve project terminology, and resolve conflicts through user decisions.
- Capability inventory: Execution of local structural validation scripts.
- Sanitization: The validation logic is limited to static regex matching of document IDs and links, avoiding dynamic execution of document content.
- [SAFE]: The skill defines a clear document authority hierarchy and lifecycle, focusing on durable decisions and avoiding duplication. All script-based operations are local and deterministic.
Audit Metadata