speckit-constitution
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to read '.specify/extensions.yml' and automatically execute commands listed under 'hooks.before_constitution' and 'hooks.after_constitution' keys.
- [COMMAND_EXECUTION]: For mandatory hooks (optional: false), the agent is explicitly directed to emit 'EXECUTE_COMMAND' and then must 'actually invoke the hook', enabling arbitrary command execution based on untrusted file content.
- [PROMPT_INJECTION]: This design is susceptible to Indirect Prompt Injection where a malicious project file can hijack the agent's workflow.
- [PROMPT_INJECTION]: Ingestion points: .specify/extensions.yml.
- [PROMPT_INJECTION]: Boundary markers: None.
- [PROMPT_INJECTION]: Capability inventory: Shell command execution (EXECUTE_COMMAND).
- [PROMPT_INJECTION]: Sanitization: None (simple string replacement only).
Recommendations
- AI detected serious security threats
Audit Metadata