plan-orchestrate
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided plan documents to generate prompts that are later intended to be executed by other agents via an orchestration tool. This creates a surface where a malicious plan document could include instructions designed to influence or hijack downstream agent behavior.
- Ingestion points: The skill reads external plan files specified by the
<plan-doc-path>argument to extract intent and steps. - Boundary markers: The skill attempts to delimit task descriptions using double quotes and includes source tracking markers like
[Plan: <path>#step-<id>]to provide context to the downstream agent. - Capability inventory: The skill is generative and does not directly execute the commands it produces, nor does it perform network operations or write to sensitive files.
- Sanitization: The instructions explicitly require escaping double quotes (
\") within task descriptions to maintain the integrity of the emitted command strings and prevent command-injection-like behavior in the shell blocks.
Audit Metadata