implement-refactor
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interprets and executes plans defined in external task files, creating a surface for indirect prompt injection where malicious instructions could be embedded in task descriptions or criteria.
- Ingestion points: External markdown files specified by the user or resolved from the
.plugin-creator/plans/directory are read and parsed in Step 1 (SKILL.md). - Boundary markers: The instructions do not define clear delimiters or use protective prompting techniques to isolate the agent from instructions that might be contained within the loaded task data.
- Capability inventory: The skill has access to a wide range of powerful tools (e.g.,
/plugin-creator:refactor-skill,plugin-creator:subagent-refactorer) and can dispatch tasks to ageneral-purposeagent with broad execution capabilities. - Sanitization: There is no evidence of sanitization or filtering of the task content; the skill's 'Gate' only verifies the presence of metadata fields, not the safety of their contents.
Audit Metadata