executing-plans
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- PROMPT_INJECTION (LOW): The skill is vulnerable to indirect prompt injection because its core function is to ingest and execute instructions from external 'plan files'.
- Ingestion points: The process begins by reading a plan file (Step 1 in
SKILL.md). - Boundary markers: The skill lacks explicit delimiters or instructions to treat the plan content as untrusted data, potentially allowing instructions within the plan to override agent constraints.
- Capability inventory: The skill instructs the agent to 'Follow each step exactly' and 'Run verifications', which may involve arbitrary command execution or file modifications depending on the agent's available tools.
- Sanitization: There is no evidence of sanitization or validation logic to filter malicious instructions within the plan file.
- Mitigation: The risk is partially mitigated by the mandatory human-in-the-loop checkpoints and 'stop' conditions described in the 'When to Stop and Ask for Help' section.
Audit Metadata