plan-eng-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a comprehensive and structured engineering review process. It provides clear guidance for the agent to follow a multi-step analysis including architecture, security, and test coverage.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool for context gathering, specifically executinggitandgh(GitHub CLI) commands inSKILL.mdto identify branch details and PR information. These operations are restricted to metadata retrieval and are standard for development workflows. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
WebSearchtool to verify architectural patterns and research best practices. This is a legitimate research function intended to improve the quality of the engineering review. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external technical plans and pull requests.
- Ingestion points: Reads project files via
ReadandGlobtools, and command output fromgit diffandgh pr viewvia theBashtool. - Boundary markers: Employs a rigid section-based review workflow and an 'Anti-shortcut clause' to prevent the agent from deviating from its instructions.
- Capability inventory: Includes file modification (
Write), shell access (Bash), and internet access (WebSearch). - Sanitization: Relies on a human-in-the-loop interaction model via
AskUserQuestion, requiring user approval for each identified issue and recommendation before proceeding.
Audit Metadata