piv-plan-implementation
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources which could be used to influence the agent's planning output.
- Ingestion points: The
$ARGUMENTSvariable, Jira/Linear/GitHub ticket descriptions, and Confluence architecture pages (SKILL.md). - Boundary markers: Absent. The instructions do not define delimiters or specific 'ignore' instructions for the content fetched from external trackers.
- Capability inventory: The agent uses tools like
gh issue view, Atlassian MCP for Jira/Confluence, and has file system write access to the.claude/plans/directory. - Sanitization: Absent. There is no mention of sanitizing or validating external content before it is incorporated into the implementation plan.
- [COMMAND_EXECUTION]: The skill instructs the agent to generate 'executable validation commands' and 'STEP-BY-STEP TASKS' (SKILL.md). While this skill performs the planning phase rather than execution, it produces commands intended for immediate execution by a downstream implementation agent. Maliciously crafted input in an external ticket could lead to the generation of dangerous commands.
- [EXTERNAL_DOWNLOADS]: The skill is designed to fetch content from remote servers, including Jira, GitHub, and various documentation sites (SKILL.md). While these are handled through established tools (MCP, GitHub CLI), they represent external dependencies and data sources that define the agent's context.
Audit Metadata