plugin-plan-implement
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes arbitrary shell commands in Step 6 (
{verification.commands[0]}) that are retrieved dynamically from a task retrieval script. This allows for the execution of any command defined in the task plan's verification criteria. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests task-specific data and executable commands from an external source without sanitization.
- Ingestion points: Data enters the workflow via the
plan-marshall:manage-tasks:manage-tasks readscript in Step 2 ofSKILL.md. - Boundary markers: There are no boundary markers or instructions to the agent to ignore embedded commands within the ingested task data.
- Capability inventory: The skill has the capability to execute shell commands (
verification.commands) and perform file read/write operations across the filesystem (Step 5). - Sanitization: No validation or sanitization is performed on the
verification.commandsor the file paths (steps[]) before they are used in shell executions or file operations.
Audit Metadata