plan-execute
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill preamble contains steering instructions like 'Ignore Claude-specific mode-switch instructions' and 'Strict execution contract' that attempt to override standard agent behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and executes instructions from plans/.md files and $ARGUMENTS, creating a significant attack surface. 1. Ingestion points: plans/.md files and $ARGUMENTS variable. 2. Boundary markers: Plans are encapsulated in tags. 3. Capability inventory: Writing files, spawning subagents, executing shell commands via tester, and performing git commits. 4. Sanitization: No sanitization or validation of the plan content is described.
- [COMMAND_EXECUTION]: The skill orchestrates subagents that perform shell operations for testing, debugging, and git repository management.
- [PRIVILEGE_ESCALATION]: The --approval=off flag enables an autonomous mode that bypasses the mandatory user-approval gate, allowing automated code commits.
Audit Metadata