control-map
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands (
mkdir,cp) to initialize compliance directory structures and templates using the platform root variable${CLAUDE_PLUGIN_ROOT}.\n- [COMMAND_EXECUTION]: It performs environment-based path discovery by checking the$POWERSUIT_OVERLAYvariable to locate optional private configuration files.\n- [DYNAMIC_EXECUTION]: A Python script is executed at runtime via a heredoc (python3 -) to read and aggregate data from thecontrol-map.csvfile, producing a summarized status report.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests various repository files to identify and map controls, creating a surface for indirect instruction processing.\n - Ingestion points:
gate/gate.json,.github/workflows/,CODEOWNERS,docs/,observability/, backup/restore jobs, access reviews, and incident records.\n - Boundary markers: Absent; the instructions do not specify delimiters to isolate ingested file content.\n
- Capability inventory: Local file system operations (
mkdir,cp) and localized Python execution.\n - Sanitization: Absent; content from the repository is read directly for mapping purposes.
Audit Metadata