frontier-plan-opencode-executor
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and execute multi-step instructions (plans) generated by external AI models, creating a surface for indirect prompt injection. \n
- Ingestion points: External implementation plans provided in the agent's context as defined in the 'When to Use' section of SKILL.md. \n
- Boundary markers: Instructions specify treating the plan as a 'strong hypothesis' rather than ground truth, though no technical delimiters or sanitization routines are provided. \n
- Capability inventory: The skill allows filesystem writes, shell execution for verification, and Git operations (SKILL.md, 'Quick Reference'). \n
- Sanitization: Relies on the agent's 'Reality Check' phase and manual user review of 'git diff' outputs. \n- [DATA_EXFILTRATION]: The skill enables 'auto-commit and auto-push' by default for completed work units. While it includes logic to avoid protected branches, automatic network operations to remote repositories present an exfiltration risk if an untrusted plan injects sensitive data or code. \n- [COMMAND_EXECUTION]: The skill grants authority to run various shell commands for repository baseline checks and tiered verification (e.g.,
git status,npm run build, and custom test scripts), creating an execution surface for command injection if the input plan is malicious.
Audit Metadata