blueprint-discovery

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted user input via the feature_description field. This input is used to drive classification logic and is directly interpolated into other tools, such as the /majestic:interview skill. The instructions lack explicit boundary markers or sanitization logic to prevent the agent from potentially following malicious instructions embedded within the user's description (Indirect Prompt Injection).
  • [COMMAND_EXECUTION]: The skill utilizes ast-grep via a Bash subprocess to perform structural analysis of the codebase. While this is a legitimate discovery tool, it involves executing shell commands based on internal logic to inspect the project's architecture and patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 05:40 AM