planning-with-files
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where external data from web searches and research findings are ingested into persistent markdown files (
notes.md) that the agent later references for decision-making. This creates a potential surface for indirect prompt injection from untrusted external content. - Ingestion points: External research findings and sources gathered via tool calls, such as the web search referenced in the examples within
references/examples.md. - Boundary markers: The skill templates do not specify the use of clear delimiters or instructions to ignore potential commands embedded within the saved research notes.
- Capability inventory: The skill utilizes standard file system tools (
Write,Read,Edit) and search capabilities to manage the task environment. - Sanitization: The instructions do not prescribe sanitization or validation of content retrieved from external sources before it is stored in the workspace.
- [COMMAND_EXECUTION]: The skill relies on standard agent operations for reading, writing, and editing local markdown files to track task progress and synthesize research. These operations are integral to the skill's stated purpose and do not involve unauthorized command execution, persistence mechanisms, or privilege escalation.
Audit Metadata