understand-domain
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands to resolve project paths and detect git worktrees during its setup phase. These include
git rev-parse,realpath,readlink,pwd, anddirname. These operations are limited to environment discovery and path resolution. - [COMMAND_EXECUTION]: The skill runs a bundled Python script (
extract-domain-context.py) to perform a lightweight scan of the project. The script extracts file trees, entry points, and metadata, writing the results to a local.understand-anything/directory within the project root. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted codebase content (source code snippets,
README.md,package.json) and passes it to a subagent for domain analysis. - Ingestion points: Reads all source files (limited by extension),
package.json, andREADME.mdwithin the project root. - Boundary markers: Not explicitly defined in the skill instructions; however, the subagent relies on a prompt template stored in
$PLUGIN_ROOT/agents/domain-analyzer.md. - Capability inventory: The skill can execute local shell commands, run a Python script, write to the local filesystem, and dispatch subagents.
- Sanitization: The Python script performs truncation and filtering of files based on
.gitignore, but does not perform specific sanitization of code content for instructions.
Audit Metadata