project-blueprint

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python script at scripts/validate_blueprint.py used to perform structural validation of project blueprints. A technical review of the script confirms it is a read-only linter that uses regular expressions and standard Python libraries to check for ID consistency and required fields. It does not perform network operations, access sensitive system paths, or execute arbitrary shell commands.
  • [DYNAMIC_EXECUTION]: The test suite (tests/) uses importlib.util to load the local validation script for automated testing. This is a standard and safe practice for unit testing in Python and does not involve the execution of untrusted or remote code.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes project requirements provided by the user to generate blueprints. While it ingests external data, it includes explicit instructions for agents to maintain boundaries between data and instructions. The risk is minimized as the skill has no capabilities for network exfiltration or privileged system access.
  • [EXTERNAL_DOWNLOADS]: The documentation references external design guidelines and companion skills hosted on GitHub. These references target well-known organizations like Vercel Labs and Anthropics. The skill explicitly instructs agents not to install these dependencies automatically, ensuring user oversight for any external additions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 06:06 AM