flow-plan
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a workflow where untrusted repository data is ingested and processed to generate plan artifacts, creating a potential vector for indirect prompt injection.
- Ingestion points: In
SKILL.md, the instructions mandate reading the "user's scope, repository instructions, relevant source, tests and executable config." - Boundary markers: The skill does not implement specific delimiters or safety instructions to distinguish between the agent's instructions and potentially malicious content embedded within the source files or repository documentation.
- Capability inventory: The skill utilizes file-reading capabilities to analyze the codebase and file-writing capabilities to persist plans in the
.plans/directory or user-specified locations. - Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested repository content before it is interpolated into the plan template.
Audit Metadata