executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and execute instructions from external implementation plans, which creates a surface for indirect prompt injection.
- Ingestion points: The process in
SKILL.md(Step 1) requires reading external plan files,Execution Readiness Views, and complexity governance documents. - Boundary markers: The instructions do not specify the use of delimiters or protective warnings to prevent the agent from obeying malicious instructions embedded within the implementation plans.
- Capability inventory: The skill possesses the capability to perform file system modifications and Git operations (commits, branch creation, worktree listing) based on the plan's contents.
- Sanitization: There is no mention of sanitizing or filtering the content of the plans; the skill relies entirely on a manual "critical review" by the agent.
Audit Metadata