executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill guides the agent to read and follow external multi-step implementation plans, establishing an inherent indirect prompt injection vulnerability surface.
- Ingestion points: The skill reads external plan documents (e.g.,
docs/plan.md) in Step 1 withinSKILL.md. - Boundary markers: Absent. While the skill instructs the agent to critically review the plan for dependency logic or missing assumptions, it does not supply delimiters or explicit guidelines to ignore malicious commands embedded inside the plan.
- Capability inventory: The skill possesses extensive system capabilities during execution, including running validation tests, modifying source code, and creating Git commits across multiple files as specified in
SKILL.md. - Sanitization: Absent. No escaping or strict structural schema enforcement is applied to the ingested text content before execution.
Audit Metadata