create-implementation-plan
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the AI agent to execute a series of shell commands (grep, sed, sort, uniq) to validate the uniqueness of identifiers (e.g., TASK-001, REQ-001) within the generated implementation plan files. This script processes local content to ensure identifier consistency.
- [EXTERNAL_DOWNLOADS]: The template provided by the skill includes a reference to img.shields.io, a well-known service used to display dynamic status badges in documentation. This is used for visual indicators in the generated Markdown file.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via the input:PlanPurpose variable, which is then used to generate content and filenames for implementation plans. 1. Ingestion points: variable input:PlanPurpose in SKILL.md. 2. Boundary markers: The skill uses a rigid Markdown template structure to contain the generated content. 3. Capability inventory: The skill has the capability to write files to the /plan/ directory. 4. Sanitization: No explicit sanitization or escaping of the input is specified in the instructions.
Audit Metadata