capsule-driver
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages a hierarchy of sub-agents (orchestrators, planners, and workers) that perform file system modifications and git operations directly in the main worktree without confinement or sandboxing.
- [PROMPT_INJECTION]: The skill processes untrusted project plan data, which presents a surface for indirect prompt injection.
- Ingestion points: Slice plans and phase definitions are ingested from the
plan.tomlfile (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore malicious content within the plan files.
- Capability inventory: The orchestration flow triggers file edits and git commits via sub-agents across the main worktree.
- Sanitization: No sanitization or verification of the external plan content is performed prior to agent processing.
Audit Metadata