plan-pipeline-execute
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several shell commands using
gitand the GitHub CLI (gh). These commands include worktree management, branch operations, and the pull request lifecycle. Parameters like{plan-name}and{task-description}are sourced from external plan files, posing a risk of command injection if the plan is malformed or malicious. - [DYNAMIC_EXECUTION]: The skill involves the creation and automated execution of new code (TDD tests and implementation tasks) through linters, type checkers, and test suites. This runtime execution of generated content is a core feature but presents a surface for executing malicious code if a sub-agent is compromised.
- [INDIRECT_PROMPT_INJECTION]: The skill uses plan files as instructions for its workflow and for sub-agent prompts.
- Ingestion points: Data is read from
docs/plans/plan-{name}.md. - Boundary markers: No explicit delimiters or safety instructions are used when interpolating plan content into prompts for sub-agents.
- Capability inventory: The skill has the ability to spawn agents that can modify files and execute shell commands via the task tool.
- Sanitization: No sanitization is documented for the plan file content before it is used in prompts or shell commands.
Audit Metadata