parallel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown plan files and interpolates their content directly into prompts for subagents, creating a surface for injection.
- Ingestion points: The orchestrator reads and parses user-supplied markdown plan files (e.g.,
plan.md) in Steps 1 through 3. - Boundary markers: The
Task Prompt Templatedoes not use explicit boundary markers or instruction-guarding delimiters to separate task data (description, criteria, validation) from the prompt's structural instructions. - Capability inventory: The subagents launched by this skill have significant capabilities, including reading files, performing codebase research, writing tests, implementing production code changes, and committing work to the repository.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the task content extracted from the plan before it is injected into the subagent prompts.
Audit Metadata