melech-plan-diff
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading untrusted project data and interpolating it into a template, which is a known attack surface for injection.
- Ingestion points: The skill reads
PLAN.mdand source code files from the repository to extract content for the diff visualization. - Boundary markers: Absent. The instructions do not provide delimiters or safety guidelines for handling the content placed into the
{{TOKEN}}placeholders. - Capability inventory: The skill (as described in
SKILL.md) reads repository files, writes a local HTML file, and triggers a browser to open it. - Sanitization: Absent during token interpolation. While the template's internal JavaScript performs basic HTML escaping for display, the initial insertion of data into the JavaScript configuration object in
template.htmlcan be bypassed by malicious input containing quotes, potentially leading to local Cross-Site Scripting (XSS).
Audit Metadata