behavior-first-planning
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands within the development environment, including standard test runners (e.g.,
cargo,pytest,go test) and specific project scripts such asscripts/check-slice-batch-size.sh. This process involves generating test code and immediately running it to observe a failure state, which constitutes a dynamic execution loop. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests external user 'intents' to generate behaviors, specifications, and executable tests.
- Ingestion points: User-provided 'intent' strings that initiate the planning process (e.g., 'plan behavior-first').
- Boundary markers: The skill does not define specific delimiters or instructions to treat the intent as untrusted data separate from the agent's core planning logic.
- Capability inventory: The agent has the capability to write multiple files (Gherkin behaviors, spec files, test scripts) and execute commands via the local testing framework.
- Sanitization: The instructions explicitly include an 'adversarial dimension checklist' that directs the agent to implement security measures such as canonicalizing strings, enforcing validation at sinks, and ensuring all failure paths result in a 'fail-closed' state.
Audit Metadata