planning-with-files
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow for multi-step research tasks that involves ingesting data from external sources (e.g., web search results) and storing it in local files such as
findings.md. These files are then re-read into the agent's context to guide future decisions. This creates a standard indirect prompt injection surface where malicious instructions hidden in web content could potentially influence the agent's behavior during later task phases. - Ingestion points: Data retrieved via browser or search operations is saved to
findings.mdandprogress.md(identified in the "2-Action Rule" and file templates). - Boundary markers: The skill does not specify the use of delimiters or specific "ignore" instructions for the content stored in these files.
- Capability inventory: The skill instructions involve file read/write operations and browser tool usage.
- Sanitization: There are no instructions for sanitizing or validating external content before it is recorded or re-read.
Audit Metadata