planning
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell-based operations to manage project state and gather context. This includes running a local Node.js script located at
.claude/scripts/set-active-plan.cjsto track active implementation plans and using the GitHub CLI (gh) to read pull requests, issues, and action logs. - [EXTERNAL_DOWNLOADS]: The agent is authorized to use the
repomixutility with the--remoteflag. This tool downloads and aggregates the content of external GitHub repositories into a single file for the agent to analyze, which involves fetching data from remote servers. - [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection (Category 8) because it processes untrusted data from external sources.
- Ingestion points: Technical context is ingested from remote GitHub repositories (via
repomix), as well as pull request comments, issue descriptions, and discussion threads (viagh). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when processing these external data streams.
- Capability inventory: The agent possesses significant capabilities, including the ability to execute shell commands, manage project tasks via
TaskCreate/TaskUpdate, and perform file system writes within the current working directory. - Sanitization: The skill does not describe any sanitization or filtering logic for content retrieved from external GitHub resources before it is interpreted by the agent.
Audit Metadata