executing-plans
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external plan files (e.g., docs/plan.md) which may contain malicious instructions if the file is attacker-controlled.
- Ingestion points: The agent reads and acts upon content from external plan files as defined in Step 1 of SKILL.md.
- Boundary markers: The skill includes a mandatory "Critical Review" phase and explicit instructions to stop and ask the user for clarification if the plan is unclear or suspicious.
- Capability inventory: The skill facilitates shell command execution (git, npm, pytest) and file modifications (updating task status and committing code) based on the plan's contents.
- Sanitization: No programmatic sanitization is applied to the plan content; the skill relies on the agent's logical reasoning and user verification during the review step.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to manage the development environment and verify code changes.
- Evidence: Instructions in SKILL.md include using git for worktree management and commits, as well as running project-specific test suites like npm test or pytest.
Audit Metadata