consensus-plan-review
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill retrieves API keys by reading sensitive environment files (
~/.codex/.envand~/.claude/.env). These paths are vendor-specific or relate to well-known AI tools.\n- [COMMAND_EXECUTION]: The skill performs dynamic command execution, invoking model-specific CLIs (pi,agy,qwen) based on configuration fromconsensus.json. It also utilizes shell pipes,grep, andsedfor environment variable extraction and session tracking.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface where user-provided implementation plans are interpolated into prompts for external models.\n - Ingestion points: User input via the
$ARGUMENTSvariable inreferences/command.md.\n - Boundary markers: The skill wraps user-provided content in
---delimiters within the sharedprompt.md.\n - Capability inventory: Access to local configuration and environment files, execution of external CLI tools, and write access to temporary directories.\n
- Sanitization: No explicit sanitization or escaping of the user-supplied task or plan content is performed before interpolation.
Audit Metadata