plan-phase-implement
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it performs actions based on content from user-supplied plan files.
- Ingestion points: Untrusted data enters the agent context through plan files (e.g., markdown files under
.agents/plans/) which the skill reads to determine its next steps. - Boundary markers: The instructions lack explicit markers or warnings to the agent to disregard instructions embedded within the processed plan data, increasing the risk that it might follow malicious instructions placed there.
- Capability inventory: The skill has the capability to write files to the workspace, update plan logs, and trigger git commit actions through suggested commands or relative skill calls.
- Sanitization: There is no mechanism described for sanitizing or filtering instructions contained within the plan files before they are implemented by the agent.
Audit Metadata