plan-pipeline-start
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing external and project-internal documentation which may contain malicious directives. Ingestion points include PRD files, docs/INFORMATION_ARCHITECTURE.md, docs/adr/*.md, and agent output logs in .claude/tasks/. While user consultation is required for PRD ambiguities in Phase 1, Phase 2 allows architectural decisions to be 'auto-resolved' without user input if three or more existing ADRs support the decision. This logic could be exploited by injecting malicious ADR files into the repository to force decisions. The skill can spawn background agents, write files to the repository, perform git commits, and auto-initiate subsequent commands without explicit sanitization of the analyzed documents.
- [DATA_EXFILTRATION]: The skill identifies and accesses sensitive project information categories and platform metadata logs. Research agent triggers explicitly include 'Auth, payments, PII, RBAC' and 'env vars'. Additionally, the instructions command reading from the .claude/tasks//output.log path, which is a hidden platform directory containing execution metadata. This provides a mechanism for aggregating sensitive system configuration and internal agent logs.
Audit Metadata