plan-0-v2-constitution
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface due to its core function of processing untrusted external data into project documentation.
- Ingestion points: The skill ingests untrusted data from the
$ARGUMENTSvariable as well as local files likeREADME.mdandCONTRIBUTING.mdduring the 'Context Gatherer' phase (Step 2). - Boundary markers: While the skill uses
<!-- USER CONTENT START -->markers for content preservation during re-entrancy, it lacks explicit security delimiters or 'ignore' instructions to prevent the agent from obeying instructions embedded within the ingested files or arguments. - Capability inventory: The skill has significant file-write capabilities, allowing it to create and update multiple markdown files in the
docs/project-rules/anddocs/domains/directories (Steps 4, 5, 6, and 9). - Sanitization: The instructions do not define any sanitization, filtering, or validation steps for the content extracted from external sources before it is written to the project's authoritative doctrine files.
- [SAFE]: The skill operates entirely within the local file system and does not perform any network operations, such as external downloads or data exfiltration.
- [SAFE]: No hardcoded credentials, secrets, or sensitive system file paths (e.g., SSH keys, AWS configs) are accessed or exposed.
- [SAFE]: The use of parallel subagents is an architectural pattern for processing speed and does not involve the execution of dynamic or obfuscated code.
Audit Metadata