execution
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow where data from a work ledger (tasks) is used as the authoritative prompt for new agent sessions.
- Ingestion points: The SKILL.md file specifies reading tasks using the tool <sam_cli/> via plan read, which fetches titles, requirements, constraints, and previous orchestrator responses from a plan address.
- Boundary markers: While the skill specifies a fresh session and zero memory for the sub-agent, there are no explicit boundary markers or instructions provided to the sub-agent to distinguish between trusted system instructions and potentially malicious task data.
- Capability inventory: The sub-agent is authorized to implement requirements and run verification commands, providing a significant capability surface (including file writes and command execution) if the task data contains malicious instructions.
- Sanitization: The process does not describe any sanitization, filtering, or escaping of task-derived content before it is dispatched as the prompt for the executing agent.
- [COMMAND_EXECUTION]: The skill process relies on the execution of various CLI commands for planning, dispatching, and updating tasks via <sam_cli/>. It also mandates running quality gates (Format, Lint, Typecheck, Test) which involve shell command execution within the agent's environment to validate task implementations.
Audit Metadata