woostack-plan
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process "approved specifications" from users, which are then used to populate task descriptions on external project management platforms (Linear, GitHub, Plane). This process creates a pathway for indirect prompt injection if the input specification contains malicious instructions intended to influence the agent's behavior or poison the task graph.
- Ingestion points: The skill accepts a free-form "approved specification" as the primary input for the
/woostack-plancommand inSKILL.md. - Boundary markers: The skill defines a strict "Direct issue contract" that requires stable task IDs and "stop markers" to delimit increments. These markers provide a structural boundary for the generated issues but do not inherently prevent the model from obeying instructions embedded within the specification text.
- Capability inventory: The skill possesses the capability to write to external project management tools via API calls to create issues, work items, and dependency relations.
- Sanitization: The skill implements an "independent read-back" verification step where the synchronized state of the external provider is read and compared against the candidate plan before the plan is considered accepted. This mitigates structural tampering but does not address the semantic content of the specifications.
Audit Metadata