planning-with-files
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of instructional documentation and markdown templates. It does not contain any executable code, shell scripts, or external dependencies.
- [SAFE]: The core workflow uses standard file operations (read, write, edit) to maintain task state in the local directory, which is a legitimate practice for long-running agent tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to gather external research and store it in
notes.mdfor later reference. This represents a potential surface for indirect prompt injection if external content contains malicious instructions. - Ingestion points: External data is ingested through search/research and stored in
notes.md(SKILL.md). - Boundary markers: The templates provided in
SKILL.mduse markdown headers to provide structural separation for external data. - Capability inventory: The skill facilitates file system operations and assumes the availability of web research tools.
- Sanitization: No specific content sanitization or instructions to ignore embedded commands are included in the provided templates.
Audit Metadata