tracking-plan-audit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from two primary sources: external source code repositories and Amplitude telemetry event metadata. This creates a surface where maliciously crafted code comments, variable names, or event schemas could attempt to influence the agent's logic or deletion recommendations.
- Ingestion points: The agent reads content from user-identified repository directories and fetches raw event/property data via the Amplitude MCP.
- Boundary markers: The instructions include high-level guidance to "not assume" layouts and "ask the user to confirm" inventories, though it lacks explicit delimiters for data processing.
- Capability inventory: The skill uses filesystem search, telemetry read capabilities, and mutation actions (branch creation and event deletion) via a connected MCP.
- Sanitization: No specific sanitization or escaping protocols are mentioned for the content extracted from source files.
- [COMMAND_EXECUTION]: In mode 5 (Dead generated-client definitions), the skill instructs the agent to "rerun affected builds and consumer type checks using the customer's actual commands." This allows for the execution of arbitrary shell commands provided by the user or found in the environment, which could be exploited if the agent is not strictly constrained to the intended build scripts.
Audit Metadata