executing-plans
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute tasks from an external 'plan file', creating a vulnerability to indirect prompt injection where instructions embedded in the plan could attempt to override agent behavior.
- Ingestion points: Step 1 ('Load and Review Plan') explicitly instructs the agent to 'Read plan file'.
- Boundary markers: The instructions lack explicit boundary markers or delimiters to isolate the plan content from the system prompt, nor do they include warnings to ignore embedded malicious instructions within the data.
- Capability inventory: The skill facilitates 'Execute Batch' operations which involve following steps, running verifications, and reporting output. These operations typically require file system access and shell command execution capabilities.
- Sanitization: There are no instructions provided to sanitize, validate, or escape the content of the plan file before the agent processes or executes the tasks described therein.
Audit Metadata