capsule-driver
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow that relies on external data sources (specifically
plan.toml) to guide the actions of the orchestrator and its subagents. This creates a surface where malicious instructions embedded in the design or plan files could influence agent behavior. - Ingestion points: The skill reads and consumes
plan.tomland phase-specific designs inSKILL.mdto drive implementation. - Boundary markers: There are no documented boundary markers or explicit instructions provided to the agent to ignore potentially malicious content within the plan files.
- Capability inventory: The orchestrator has the capability to spawn subagents, which in turn have write access to the main worktree to implement source changes and commit directly to the repository.
- Sanitization: No sanitization, schema validation, or filtering is specified for the input plan files before they are processed by the tiered agent structure.
Audit Metadata