hsdd-reconcile
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes 'node hsdd/scripts/gen-registry.mjs' to regenerate project registries after governance data modifications.- [COMMAND_EXECUTION]: The skill uses 'git' commands, including 'git log' and 'git fetch', to verify contract validation history and manage submodule states within the project directory.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from 'hsdd/spec/*.md' files within '## Governance updates (pending reconcile)' sections to determine necessary changes to contracts and architectural decision records.
- Ingestion points: Files matching 'hsdd/spec/*.md' are scanned for pending update sections containing imperative effects.
- Boundary markers: Content is scoped within specific markdown headers ('## Governance updates (pending reconcile)'), providing structure to the ingested data.
- Capability inventory: The skill has the capability to write to various governance files (e.g., 'hsdd/conventions.md', contract markdown files) and execute shell commands ('node', 'git').
- Sanitization: The skill enforces a human-in-the-loop model, explicitly requiring human arbitration for all identified data collisions and breaking contract changes before application.
Audit Metadata