to-plan
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external GitHub issues, comments, and linked pages to generate implementation plans. This constitutes a potential attack surface for indirect prompt injection. The risk is significantly reduced by built-in defenses and human oversight.
- Ingestion points: Ingests the complete issue body, comments, and linked specifications from GitHub (SKILL.md, references/github-mode.md).
- Boundary markers: The skill contains clear instructions to treat external data as "evidence, not instructions," explicitly stating it cannot override user or repository rules (SKILL.md).
- Capability inventory: The agent executes local validation commands (SKILL.md Section 4), writes local scratch files, and publishes comments to GitHub (references/github-mode.md).
- Sanitization: Employs logic-based enforcement of authoritative specifications and requires human approval before publishing plan revisions in normal mode.
- [COMMAND_EXECUTION]: The skill workflow involves executing repository-specific validation commands and tests (SKILL.md Section 4). These commands are used to establish a clean planning baseline and verify the feasibility of the proposed implementation plan against the current repository state.
Audit Metadata