blueprint-sync
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates file names from
manifest.jsondirectly into shell commands without sanitization or quoting. - Evidence: Step 2a (
test -f .claude/rules/{name}.md) and Step 2b (sha256sum .claude/rules/{name}.md | cut -d' ' -f1). - Risk: If a rule name in the manifest contains shell metacharacters (e.g.,
;,&,|, or backticks), it could lead to arbitrary command execution when the skill is run. - [PROMPT_INJECTION]: The skill processes untrusted data from local project files that could contain malicious instructions designed to hijack the agent's context.
- Ingestion points:
docs/blueprint/manifest.json,.claude/rules/*.md, anddocs/prds/*(Step 1, Step 2, Step 5). - Boundary markers: None explicitly defined to separate data from instructions or to warn the agent about embedded prompts.
- Capability inventory: Reading and writing to the local filesystem, including updating the manifest and regenerating rule files (Step 7).
- Sanitization: No sanitization or validation of the content of the manifest or rule files before processing.
Audit Metadata