plan-writing
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests
decisionLogdata which may be untrusted and uses it to construct task files and operational commands. The requirement to include concrete pre-check, apply, and rollback commands for infrastructure tasks (Invariant 4) creates a specific vector where malicious input can be promoted to executable-looking documentation. - Ingestion points: The
decisionLogandprojectSluginputs are used to drive the plan generation and file path creation. - Boundary markers: No explicit instructions are provided to the agent to treat input data as untrusted or to ignore embedded instructions.
- Capability inventory: The skill writes files to
docs/tasks/task.<reference>.md, creating a potential path traversal surface if the reference is derived from unsanitized input. - Sanitization: No validation or sanitization of the input content is specified before it is included in the output plan or used for file naming.
Audit Metadata