plugin-apply-lessons-learned
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by ingesting content from external lesson files.
- Ingestion points: Reads data from files in the
.plan/local/lessons-learned/directory via themanage-lessonsscript. - Boundary markers: No markers, delimiters, or system instructions are used to distinguish lesson content from the existing component documentation when editing files in Step 4.
- Capability inventory: The skill possesses file-write permissions for the
marketplace/bundles/directory, enabling modification of agent instructions (agents/*.md) and skill definitions (SKILL.md). It also has command-execution capabilities to run Python scripts. - Sanitization: While the workflow suggests validating parameter syntax, there is no mechanism to sanitize the actual content of the lessons before they are integrated into documentation, allowing malicious instructions to be persisted in the agent's core files.
- [COMMAND_EXECUTION]: The skill executes a local Python script (
.plan/execute-script.py) usingpython3in Step 3. - Evidence: The workflow instructs the agent to run
python3 .plan/execute-script.py plan-marshall:manage-lessons:manage-lessons list [--component-name {name}]. - Risk: The
{name}variable is derived directly from user-provided parameters (command,agent,skill). If the execution environment or the script wrapper does not properly handle shell metacharacters, this could lead to command injection.
Audit Metadata