structured-autonomy-generate
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from
plans/{feature-name}/plan.md, which is an untrusted ingestion point that could contain malicious instructions. - Ingestion points:
plans/{feature-name}/plan.md(read in Step 1). - Boundary markers: Absent; there are no specific delimiters or instructions to the agent to disregard embedded directives in the plan file.
- Capability inventory: The skill can write files (
plans/{feature-name}/implementation.md), manage Git branches, and executerunSubagentfor research. - Sanitization: Absent; the skill extracts steps and generates "copy-paste ready code" based on the content of the external plan without validation.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform repository state modifications, specifically creating and switching branches based on instructions found in the plan file.
- [EXTERNAL_DOWNLOADS]: The
research_taskcomponent instructs the agent to fetch official documentation for libraries and frameworks from external sources. While intended for context gathering, this involves network operations triggered by the contents of the project plan.
Audit Metadata