ulw-plan
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script located at
<skill-root>/scripts/scaffold-plan.mjs. This script is part of the skill's own package and is used to manage plan artifacts. The agent passes a<slug>and specific operational flags as arguments to the command.\n- [EXTERNAL_DOWNLOADS]: The skill defines a 'librarian' agent role dedicated to conducting external research. This involves fetching information from the web to resolve planning forks when the local repository is insufficient, introducing external data into the agent's reasoning process.\n- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection due to its core function of processing untrusted data from the repository and external sources to generate execution plans.\n - Ingestion points: Untrusted data enters the agent context through file reading, grep, and external documentation research performed by the 'librarian' agent.\n
- Boundary markers: There are no explicit instructions or delimiters defined in the prompt to separate external content from instructions or to warn the agent against executing embedded commands.\n
- Capability inventory: The skill can write files to the local filesystem (under the
.omo/directory) and execute a local Node.js script via shell command.\n - Sanitization: The skill does not implement or specify any sanitization, escaping, or validation logic for the data it retrieves before incorporating it into plan artifacts.
Audit Metadata