bms-plan-review
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes implementation plans sourced from files, PR comments, or conversation history, which may contain untrusted data.
- Ingestion points: The agent is instructed to read plans from PR comments and external files in
SKILL.md(Step 1). - Boundary markers: No explicit delimiters or instructions are provided to the agent to prevent it from following commands potentially embedded within the implementation plans.
- Capability inventory: The skill possesses the ability to read arbitrary files in the repository, use the
CodeGraphtool, and execute database inspection commands viapgdb. - Sanitization: There is no mention of sanitizing or validating the contents of the plans before processing.
- [COMMAND_EXECUTION]: The skill instructs the agent to use command-line tools to gather information.
- Evidence:
SKILL.mddirects the agent to runpgdb get-stats <database dir> <schema.table>to verify database details mentioned in implementation plans.
Audit Metadata