understand-domain

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several shell commands to resolve project paths and detect git worktrees during its setup phase. These include git rev-parse, realpath, readlink, pwd, and dirname. These operations are limited to environment discovery and path resolution.
  • [COMMAND_EXECUTION]: The skill runs a bundled Python script (extract-domain-context.py) to perform a lightweight scan of the project. The script extracts file trees, entry points, and metadata, writing the results to a local .understand-anything/ directory within the project root.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted codebase content (source code snippets, README.md, package.json) and passes it to a subagent for domain analysis.
  • Ingestion points: Reads all source files (limited by extension), package.json, and README.md within the project root.
  • Boundary markers: Not explicitly defined in the skill instructions; however, the subagent relies on a prompt template stored in $PLUGIN_ROOT/agents/domain-analyzer.md.
  • Capability inventory: The skill can execute local shell commands, run a Python script, write to the local filesystem, and dispatch subagents.
  • Sanitization: The Python script performs truncation and filtering of files based on .gitignore, but does not perform specific sanitization of code content for instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 11:42 AM