plan-v2-extract-domain
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Potential for indirect prompt injection exists as the skill reads and processes the content of the local codebase. \n
- Ingestion points: Reads source code files, configuration files, and existing domain documentation in
docs/domains/(Steps 0, 1, 2, 5). \n - Boundary markers: Absent. Discovery subagent prompts do not include delimiters or instructions to ignore directives found within file content. \n
- Capability inventory: File system read/write access (primarily to documentation paths), subagent task delegation, and
ask_usertool interaction. \n - Sanitization: Discovered data is presented to the user and written to markdown files without explicit sanitization or filtering.\n- [PROMPT_INJECTION]: The skill interpolates user-provided arguments directly into subagent discovery prompts. This allows for potential direct prompt injection where a user could provide a crafted concept name string designed to influence the subagent's instructions, though this is mitigated by human-in-the-loop review.
Audit Metadata