subagent-planificator
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes bash script templates for local file orchestration, polling, and status management in
references/waiting-script.md. These scripts use standard system utilities such asls,grep,sed,awk, andyqto manage the planning lifecycle.- [COMMAND_EXECUTION]: Thewait_with_callback.shtemplate inreferences/waiting-script.mdemploys theevalcommand to execute callback functions when specific files are detected. This represents a form of dynamic code execution used for internal task orchestration.- [PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection because agents process markdown files generated by other specialist agents during the iteration rounds. - Ingestion points: Subagent-generated markdown files (e.g.,
draft-*.md,review-*.md) are read by the orchestrator and other specialists as described inSKILL.mdandreferences/plan-templates.md. - Boundary markers: Absent; the templates do not define explicit delimiters or instructions to ignore embedded commands within the specialist-generated content.
- Capability inventory: The skill relies on bash-based file operations, status tracking, and orchestration logic across all referenced scripts.
- Sanitization: There is no evidence of validation, filtering, or sanitization performed on the content of the markdown files before they are ingested into the context of other agents.
Audit Metadata