writing-implementation-plans
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from design documents and external research tools to generate implementation tasks, which can be a vector for malicious instructions.
- Ingestion points: Reads content from design plan files (
DESIGN_PATH) and data retrieved byinternet-researcherandremote-code-researchersubagents inSKILL.md. - Boundary markers: Uses HTML comment markers (e.g.,
<!-- START_PHASE_N -->) to target specific sections of design documents for extraction. - Capability inventory: The skill dispatches subagents for codebase investigation and code review, uses
TaskCreateandTaskUpdatefor workflow management, and writes phase files to the local filesystem. - Sanitization: To mitigate risks, the instructions mandate generating all code fresh from the current codebase state and explicitly warn against copying illustrative code examples from the design documents.
- [EXTERNAL_DOWNLOADS]: The skill dispatches an
internet-researchersubagent to retrieve documentation, API references, and technical standards from external sources. - Evidence: The Tier 1 research framework in
SKILL.mdinstructs the subagent to seek out official documentation, common patterns, and standard specifications like OAuth2 or JWT. - [REMOTE_CODE_EXECUTION]: The skill utilizes a
remote-code-researchersubagent to analyze internal implementations by fetching source code from remote repositories. - Evidence: The "Decision Framework" in
SKILL.mdtriggers remote code analysis when documentation is insufficient or when understanding extension points of third-party dependencies is required.
Audit Metadata