qp-plan
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local shell scripts, specifically
qp_tools.sh, to classify targets and run validation checks using theawkutility. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external web pages and desktop applications (via accessibility snapshots and screenshots) to create inventories and test plans.
- Ingestion points: Accessibility snapshots and application screenshots are ingested as the primary source for the inventory in SKILL.md.
- Boundary markers: The instructions lack specific delimiters or guardrails to prevent the model from following malicious instructions potentially embedded in the target application's UI.
- Capability inventory: The skill possesses file writing and command execution capabilities that could be influenced by processed data.
- Sanitization: No sanitization or filtering of the target application's content is described before processing by the agent.
Audit Metadata