review-plan
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content (implementation plans) which could contain malicious instructions designed to influence the agent's review logic.
- Ingestion points: The skill reads user-specified plan files in SKILL.md through commands such as cat, grep, and find during its multi-cycle review process.
- Boundary markers: The prompt does not define explicit delimiters or instructions to ignore embedded commands within the plan documents being reviewed.
- Capability inventory: The skill is strictly limited to read-only shell commands (ls, cat, git status, etc.) as defined in the 'read-only 隔離' section of SKILL.md, and it explicitly forbids file writing, network operations, and package installation.
- Sanitization: No specific sanitization, escaping, or validation logic is applied to the content of the plan files before processing.
Audit Metadata