plan
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to read various files from the local repository and the
vault/directory (such asvault/README.md,decisions.md,CLAUDE.md, andAGENTS.md). These files are considered untrusted inputs that could contain malicious instructions aimed at influencing the agent's planning output. - Ingestion points:
vault/README.md,vault/index.md,decisions.md,CLAUDE.md,AGENTS.md(SKILL.md). - Boundary markers: None identified.
- Capability inventory: File system read/write, command execution (via prototypes).
- Sanitization: None identified.
- [DYNAMIC_EXECUTION]: The instructions mandate that the agent 'Settle open questions by running, not asking' using 'throwaway prototypes.' This requires the agent to generate and execute code snippets on the fly to test API behaviors or environment configurations.
- [COMMAND_EXECUTION]: The skill mentions executing specific scripts (e.g.,
scripts/checkout) and 'verification commands' found within the repository to explore the codebase and validate the plan's feasibility.
Audit Metadata