aw-create-plan
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell utilities within
SKILL.mdto manage its internal state.\n - It executes
git branch --show-currentto determine the working directory path.\n - It uses
mkdir,ls,sed,sort, andtailto calculate the next version number for plan snapshots.\n- [PROMPT_INJECTION]: The skill inSKILL.mdprovides an attack surface for indirect prompt injection by persisting chat context into permanent project files.\n - Ingestion points: Data from the current conversation (which may include untrusted user input or external data) is ingested during Step 2 to populate the plan template.\n
- Boundary markers: The plan template lacks delimiters or explicit instructions to ignore potentially malicious commands embedded in the processed text.\n
- Capability inventory: The skill possesses the ability to write files (
plan.md,plan.vN.md) and execute shell commands. The generated plan is specifically intended to be used by future AI sessions, which typically have broader system access.\n - Sanitization: No sanitization, escaping, or validation logic is applied to the content before it is written to the file system.
Audit Metadata