implement-plan
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading and executing instructions from external task files located in the docs/threads lineage. It is instructed to execute steps literally, which can lead to unintended behavior if plan artifacts are sourced from untrusted contributors.\n
- Ingestion points: Multi-file plan artifacts (plan.md and tasks/*.md).\n
- Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions when processing the content of these files.\n
- Capability inventory: Subprocess execution (verification commands), file system modification (writing source code and reports), and git operations (committing changes).\n
- Sanitization: There is no evidence of sanitization or validation of the task file content before implementation or execution.\n- [COMMAND_EXECUTION]: The skill executes arbitrary commands provided in the Verification block of plan tasks (e.g., npm test, grep, or test -f). It also automatically runs project-specific 'standing gates' such as linters, formatters, or typecheckers discovered in the repository environment.\n- [DATA_EXFILTRATION]: The skill has the capability to read files and execute commands. If a malicious plan artifact were to be processed, these capabilities could be combined to access sensitive configuration files or environment variables, although no explicit exfiltration logic is present in the skill itself.
Audit Metadata