executing-plans
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to ingest and execute instructions from a "plan file," which acts as an external data source. This creates a risk where malicious instructions embedded in a plan could be executed by the agent.
- Ingestion points: The agent is instructed to "Read plan file" in Step 1 of the process defined in
SKILL.md. - Boundary markers: The instructions lack specific boundary markers or delimiters to isolate the plan content or warn the agent to ignore instructions embedded within the data.
- Capability inventory: The skill grants the agent the capability to "Follow each step exactly" and "Run verifications as specified," which implies significant system interaction and command execution capabilities directed by the plan file.
- Sanitization: There is no technical sanitization or validation of the plan content. The skill relies on the agent's "critical review" and mandatory human-in-the-loop reporting as the primary safety controls.
Audit Metadata