qstack-ask-plan-open-questions
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local shell script
qstack/scripts/serve.shif present in the repository to verify the integrity and rendering of HTML plans. - [PROMPT_INJECTION]: The skill ingests content from project planning files (
plan.html,plan.md) to extract open questions and decision points, creating a surface for indirect prompt injection. - Ingestion points: Plan files located at
qstack/compound_engineering/plans/*/plan.htmland related Markdown drafts (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the ingested plan data.
- Capability inventory: The skill has the ability to perform file writes (updating HTML/Markdown plans) and execute a local script (serve.sh) (SKILL.md).
- Sanitization: No content sanitization or validation mechanisms are described for the plan files before they are processed by the agent.
Audit Metadata