executing-plans
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and execute tasks from external 'plan' files, creating a surface for indirect prompt injection where malicious instructions could be embedded in the plan data.
- Ingestion points: Plan files loaded and read in Step 1 of the process.
- Boundary markers: The skill includes a general protocol to treat external data as hostile, but no specific technical delimiters for plan content are defined in the instructions.
- Capability inventory: The skill has terminal execution capabilities via the ExecutionProxy interface (e.g., 'rtk npm test') and file system write capabilities via MemoryStore and plan status updates.
- Sanitization: The protocols mandate redacting secrets and PII before sharing context with subagents, which helps prevent data exfiltration but does not eliminate the risk of the agent following injected instructions within the plan.
Audit Metadata