planning

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell-based operations to manage project state and gather context. This includes running a local Node.js script located at .claude/scripts/set-active-plan.cjs to track active implementation plans and using the GitHub CLI (gh) to read pull requests, issues, and action logs.
  • [EXTERNAL_DOWNLOADS]: The agent is authorized to use the repomix utility with the --remote flag. This tool downloads and aggregates the content of external GitHub repositories into a single file for the agent to analyze, which involves fetching data from remote servers.
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection (Category 8) because it processes untrusted data from external sources.
  • Ingestion points: Technical context is ingested from remote GitHub repositories (via repomix), as well as pull request comments, issue descriptions, and discussion threads (via gh).
  • Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing these external data streams.
  • Capability inventory: The agent possesses significant capabilities, including the ability to execute shell commands, manage project tasks via TaskCreate/TaskUpdate, and perform file system writes within the current working directory.
  • Sanitization: The skill does not describe any sanitization or filtering logic for content retrieved from external GitHub resources before it is interpreted by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 03:17 AM