executing-plans
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes external implementation plans without explicit boundary markers or sanitization, potentially allowing untrusted content to influence agent behavior.
- Ingestion points: In
SKILL.md, Step 1 explicitly directs the agent to "Read plan file". - Capability inventory: The skill grants significant influence to the external content by instructing the agent in Step 2 to "Execute Batch" and "Follow each step exactly" based on the bite-sized steps found in the plan. This can include writing code or running verification commands as specified by the untrusted plan.
- Boundary markers: The instructions lack delimiters or specific warnings to the agent to distinguish between the skill's control logic and the data provided in the external plan.
- Sanitization: No logic is provided to validate the source of the plan or sanitize its content before the agent proceeds with execution.
Audit Metadata