plan-orchestrate
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted plan documents as its primary input, creating a potential attack surface.
- Ingestion points: Plan documents are read from user-provided paths defined in SKILL.md.
- Boundary markers: The skill uses structured Markdown tables and code blocks to separate generated content from status reports, and provides clear 'BLOCKED' indicators for untrusted steps.
- Capability inventory: The skill is restricted to generative text output and has no access to subprocesses, network requests, or file-writing tools.
- Sanitization: The instructions mandate a security scan in Phase 3 to detect prompt injection, secret access, or destructive requests in the source plan, blocking any step that fails this check.
- [COMMAND_EXECUTION]: The skill identifies and maps plan steps to a catalog of slash commands but is explicitly prohibited from executing them. It serves strictly as a command generator, ensuring that no code or system actions are performed without manual user intervention.
Audit Metadata