planning-with-files
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a framework for ingesting untrusted data from external web sources (via WebFetch and WebSearch) and storing it in persistent memory files such as findings.md. This creates a potential surface for indirect prompt injection if external content contains instructions designed to influence the agent when it later reads these files.
- Ingestion points: Untrusted content from web tools is directed to be saved into project files (findings.md, task_plan.md) as described in the SKILL.md rules and examples.
- Boundary markers: Templates in the templates/ directory provide structure (headers, tables, comments) but do not include specific delimiters or 'ignore' instructions to isolate untrusted external content from agent directives.
- Capability inventory: The agent has access to sensitive capabilities including Bash and file system modification tools (Write, Edit) which could be misused if an injection is successful.
- Sanitization: The skill relies on the agent's manual transcription of findings and does not implement automated sanitization or filtering of the ingested content.
Audit Metadata