planning-with-files
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a 'working memory on disk' pattern where the agent is instructed to write findings, research, and plans to markdown files and then re-read them to guide future actions. This creates an attack surface where malicious instructions embedded in untrusted data (e.g., from web search results or analyzed external files) could be saved to these planning files and subsequently executed by the agent during its periodic 'read-before-decide' loops.\n
- Ingestion points: The agent is instructed in
SKILL.mdandexamples.mdto readtask_plan.md,findings.md, andprogress.mdbefore making major decisions.\n - Boundary markers: The templates provided in
templates/do not include distinct delimiters or warnings to ignore embedded instructions within the user-provided or research content.\n - Capability inventory: The skill methodology assumes the agent has permissions to read/write files and execute shell scripts (
scripts/init-session.sh,scripts/check-complete.sh).\n - Sanitization: There is no mechanism in the scripts or templates to sanitize or escape data harvested from external sources before it is persisted to the planning files.
Audit Metadata