concept-guardrails-cn
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a context injection mechanism via Claude Code hooks (PreToolUse and PostToolUse) that automatically reads local specification files to guide the agent. This creates an attack surface where maliciously crafted specifications could influence agent behavior.
- Ingestion points: Project files such as CONCEPT.md, PIPELINE.md, and SYNCS.md are read by runtime/scripts/drift-context.sh and runtime/scripts/post-check.sh.
- Boundary markers: Injected content is labeled with section headers (e.g., [relative_spec ## interactions]), but does not include explicit instructions for the LLM to ignore embedded commands.
- Capability inventory: The agent platform provides tools for file system modification and shell command execution.
- Sanitization: Content is escaped into JSON format via jq to ensure safe transport, but no semantic filtering of the specification text is performed.
- [COMMAND_EXECUTION]: The skill utilizes local shell scripts to perform metadata analysis, check for file freshness, and identify uncovered modules within the project. These scripts use standard utilities such as find, sed, awk, and jq. These operations are restricted to the local repository and do not exhibit dangerous execution patterns.
- [SAFE]: The skill's behavior aligns with its stated purpose of providing architectural guardrails. The author, ontology-of-everything, is documented, and external references to the wyx framework and the author's GitHub repository are informational and consistent with the project's documentation.
Audit Metadata