dex-plan
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown content from planning and design documents to automatically generate tasks and subtasks. This creates a surface where instructions embedded in the data could influence agent behavior.\n
- Ingestion points: Reads local markdown files (e.g., 'SPEC.md', 'ROADMAP.md', '~/.claude/plans/*.md').\n
- Boundary markers: None identified. The agent is instructed to read the full context and analyze the structure without explicit delimiters or instructions to ignore embedded commands.\n
- Capability inventory: Shell command execution via 'dex' to create tasks and subtasks.\n
- Sanitization: None identified. The agent extracts subtask descriptions and context directly from user-controlled markdown sections.\n- [EXTERNAL_DOWNLOADS]: The skill instructions specify the use of 'npx @zeeg/dex' if the local 'dex' binary is unavailable. This results in the download and execution of an external Node.js package from the npm registry.\n- [COMMAND_EXECUTION]: The skill relies on executing shell commands through the 'dex' CLI tool to perform its primary functions, including plan analysis and task creation.
Audit Metadata