create-durable-plan
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, specifically 'official docs' for libraries and APIs, and use this information to define 'patch recipes' and 'verify commands' for later execution by a downstream agent. This creates an attack surface where malicious content in a third-party website could influence the generated commands.
- Ingestion points: SKILL.md (Workflow Step 4) and references/research.md (External docs section).
- Boundary markers: The skill instructs the agent to separate facts from inferences in TRACE.md, but there are no explicit instructions or delimiters in the generated plan to warn the implementing agent to treat recipes as potentially unsafe content derived from external sources.
- Capability inventory: The generated plan files (PLAN.md, EXECUTION.md) and phase files contain shell commands for verification and file modification recipes intended for automated execution.
- Sanitization: No explicit sanitization or validation of external content is described.
- [EXTERNAL_DOWNLOADS]: The research workflow requires fetching external documentation from URLs to inform the plan. The skill does not define a whitelist of trusted domains, allowing network requests to any domain associated with libraries or tools found in the codebase.
- [COMMAND_EXECUTION]: During the research phase, the agent is authorized to run 'Inspection commands' such as git status, test --help, or listing package scripts. While these are intended to be read-only state-printing commands, they represent a legitimate command execution capability on the host environment.
Audit Metadata