subagent-planificator

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes bash script templates for local file orchestration, polling, and status management in references/waiting-script.md. These scripts use standard system utilities such as ls, grep, sed, awk, and yq to manage the planning lifecycle.- [COMMAND_EXECUTION]: The wait_with_callback.sh template in references/waiting-script.md employs the eval command to execute callback functions when specific files are detected. This represents a form of dynamic code execution used for internal task orchestration.- [PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection because agents process markdown files generated by other specialist agents during the iteration rounds.
  • Ingestion points: Subagent-generated markdown files (e.g., draft-*.md, review-*.md) are read by the orchestrator and other specialists as described in SKILL.md and references/plan-templates.md.
  • Boundary markers: Absent; the templates do not define explicit delimiters or instructions to ignore embedded commands within the specialist-generated content.
  • Capability inventory: The skill relies on bash-based file operations, status tracking, and orchestration logic across all referenced scripts.
  • Sanitization: There is no evidence of validation, filtering, or sanitization performed on the content of the markdown files before they are ingested into the context of other agents.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 02:57 PM