planning-with-files
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill defines a
PreToolUsehook that automatically reads the first 30 lines oftask_plan.mdinto the agent's context window before every use ofWrite,Edit, orBashtools. This behavior is intended to refresh the agent's goals but creates a vulnerability where malicious instructions within the plan file could influence the execution of the subsequent tool. - Ingestion points:
SKILL.md(viaPreToolUsehook readingtask_plan.mdfrom the current working directory). - Boundary markers: None. The content of the file is echoed into the context without delimiters or warnings to ignore embedded instructions.
- Capability inventory: The skill is granted access to high-risk tools including
Bash,Write,Edit, andWebFetchin its configuration. - Sanitization: None. The file content is read and injected directly without validation or escaping.
Audit Metadata