ds-plan-loop
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill orchestrates a loop where the agent writes, critiques, and subsequently reads from a local file (e.g.,
PLAN.mdorPROGRESS.md) to guide its actions. This creates an attack surface where malicious data within a workspace could attempt to influence the agent's future commands through the plan file. - Ingestion points: The agent is instructed to read
PLAN.mdorPROGRESS.mdin steps 3, 4, and 5 to determine its next actions. - Boundary markers: The skill does not define specific delimiters or warnings to ignore instructions embedded within the data it reads from the plan file.
- Capability inventory: The workflow involves executing shell commands and performing file system operations (Step 6 and 7), which are the primary actions directed by the stored plan.
- Sanitization: There is no explicit sanitization or validation of the plan content; however, the skill includes a 'Critique' phase (Step 4) which serves as a logical verification step to mitigate errors or misleading plans.
Audit Metadata