constraint-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation and use of several well-known industry-standard tools for quality assurance and security, including Lighthouse, Semgrep, Gitleaks, OSV-Scanner, and Axe-core. These tools are fetched from public registries (NPM, Pip, Brew) and are used for their intended purpose of project hardening.
- [COMMAND_EXECUTION]: The skill defines various lifecycle commands for building, verifying, and reviewing code. It also includes a reference implementation of a Node.js script (
floor-guard.mjs) that executes shell commands viaexecFileSyncto interact withgitand analyze file diffs. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves analyzing project source code and git diffs to detect regressions or suppression comments (e.g.,
@ts-ignore). This constitutes an attack surface where malicious code could attempt to influence the agent's behavior, although the skill's explicit purpose is to identify and block such patterns.
Audit Metadata