constraint-driven-development
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing well-known security and development tools such as Semgrep, Gitleaks, Lighthouse, and Axe-core from official registries (npm, pip, brew).
- [COMMAND_EXECUTION]: The provided reference script (
floor-guard.mjs) executes localgitcommands to analyze codebase changes for quality regressions. - [INDIRECT_PROMPT_INJECTION]: The skill relies on instructions found within the project's
CONSTRAINTS.mdfile to enforce development standards. - Ingestion points: The skill reads
CONSTRAINTS.mdfrom the repository root. - Boundary markers: Instructions explicitly direct the agent not to weaken existing constraints and to flag changes to the file for human review.
- Capability inventory: The skill uses CLI tools for scanning (static analysis, secrets, performance) and local git diffing.
- Sanitization: The implementation uses regular expressions to detect and prevent common bypass patterns such as lint suppressions or skipped tests.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration were detected; the skill is focused on improving software quality and security posture.
Audit Metadata