doc-driven-development — agentic threat model

Not certain from the listing — relies on Claude Code's underlying Claude models. Vulnerable to indirect prompt injection if a malicious markdown design document contains instructions that hijack the model's reasoning to write backdoors into the codebase.

The agent treats local markdown files as the primary source of truth. If these files are poisoned or modified by an untrusted actor (e.g., via a malicious git pull), the agent will faithfully implement the malicious specifications.

Implements a plan-from-markdown workflow that translates high-level documentation into file system edits. Vulnerabilities in the parsing or execution of these plans could lead to arbitrary file writes or directory traversal within the working tree.

Not certain from the listing — as a Claude Code plugin, it likely runs locally on a developer's workstation. If not sandboxed, compromised execution could lead to full host compromise, local credential theft, or unauthorized code commits.

Not certain from the listing — there is no mention of built-in guardrails, dry-run verifications, or semantic diff evaluations to ensure the generated code matches the safe intent of the documentation before applying changes.

Not certain from the listing — lacks explicit authorization controls or policy enforcement mechanisms to restrict which directories or files the agent is permitted to modify based on the markdown input.

Operates as a plugin within the Claude Code ecosystem. It interacts directly with the host environment's developer tools, creating a risk of cascading compromise if chained with other local development plugins.