constitution-guardian
Enforce Constitution Compliance in Devflow Docs
Devflow teams need quick checks that stop incomplete requirements and exposed secrets before they spread. This skill defines a real-time guardrail for focused Constitution violations during document edits.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "constitution-guardian" from https://skillstore.io/skills/dimon94-constitution-guardian.md and its manifest at https://skillstore.io/api/skills/dimon94-constitution-guardian/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "constitution-guardian". A PRD section contains a deferred user story, a FIXME note, and a sample API key value.
Expected outcome:
The review reports three blocking issues: partial implementation, unresolved fix work, and a hardcoded secret pattern. It recommends completing the content and replacing the secret value with runtime configuration.
Using "constitution-guardian". A technical design references environment variables by name but does not include values.
Expected outcome:
The focused guardrail finds no hardcoded secret value. It recommends running the broader Constitution validation before phase completion.
Using "constitution-guardian". A legacy document includes a verified marker to bypass the guardrail.
Expected outcome:
The review asks for the migration reason, reviewer approval, and follow-up validation because the marker disables normal blocking behavior.
Security Audit
Medium RiskStatic command and secret detections are false positives from Markdown examples, regex patterns, and policy prose. The remaining security concern is the documented bypass path, which can disable guardrail enforcement without a stronger approval process.
Confirmed security concerns (1)
Risk Factors
βοΈ External commands (45)
π Env variables (5)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/dimon94-constitution-guardian/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/dimon94-constitution-guardian?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/dimon94-constitution-guardian?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dimon94-constitution-guardian/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/dimon94-constitution-guardian.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA Β· BibTeX Β· CFF)
APA citation
Dimon94. (2026). constitution-guardian security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dimon94-constitution-guardian/audits/9BibTeX citation
@techreport{dimon94-dimon94-constitution-guardian-2026,
author = {Dimon94},
title = {constitution-guardian security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/dimon94-constitution-guardian/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "constitution-guardian security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "Dimon94"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/dimon94-constitution-guardian/audits/9"
identifiers:
- type: other
value: "skillstore:dimon94-constitution-guardian:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Review PRD Drafts Before Save
Detect placeholder requirements, deferred scope, and secret-like values while a product requirements document is being edited.
Protect Technical Design Documents
Flag hardcoded credentials and incomplete implementation notes before technical designs move into build planning.
Govern Devflow Exceptions
Document when a verified marker or temporary skip is used, so compliance exceptions are visible to reviewers.
Try These Prompts
Use constitution-guardian to review this PRD for partial implementation notes and hardcoded secret examples. Report each violation with a short fix.
Use constitution-guardian to inspect this TECH_DESIGN section. Identify hardcoded secrets, unsafe configuration examples, and safer wording.
Use constitution-guardian to review this legacy devflow document. Explain whether the verified marker is justified and list required approvals.
Using constitution-guardian rules, propose an enforcement policy for devflow documents, including line reporting, bypass controls, and batch validation handoff.
Best Practices
- Use the guardrail during active document edits, then run full Constitution validation before phase completion.
- Replace secret-like examples with neutral placeholders that cannot be mistaken for credentials.
- Track every bypass marker or temporary skip with a clear owner, reason, and expiration.
Avoid
- Do not use bypass settings as a normal workflow shortcut for incomplete documents.
- Do not rely on this focused guardrail as the only Constitution compliance check.
- Do not include realistic API keys, passwords, or tokens in examples.