ai-create-plan
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
git rev-parseandlsvia a Bash interface to identify project roots and manage files within the local Obsidian vault. These operations are necessary for the skill's core functionality. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the
$OBSIDIAN_AI_VAULTenvironment variable and the user's$HOMEdirectory to locate the Obsidian vault for writing plan documents. While this involves reading local file paths, it does not exfiltrate data to external domains. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to perform a deep analysis of a repository's source code and documentation folders. This exposes the agent to untrusted data that could contain malicious instructions intended to influence the generation of the implementation plan.
- Ingestion points: Source code files and documentation within the analyzed repository (SKILL.md).
- Boundary markers: The skill does not define specific delimiters or isolation instructions to prevent the agent from obeying prompts found within the analyzed files.
- Capability inventory: The agent can read and write to the local filesystem and execute directory listing and git commands.
- Sanitization: There is no explicit mechanism described to sanitize or filter out instructions from the ingested repository content.
Audit Metadata