product-deepen-plan
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to execute local Go scripts (e.g.,
go run ../../scripts/cmd/assess) and Git operations (git add,git commit). These operations are used for managing the lifecycle of implementation plans, including state assessment, learning retrieval, validation, and versioning. - [INDIRECT_PROMPT_INJECTION]: The skill processes external implementation plans and Product Requirement Documents (PRDs) located in the
.agents/products/directory. This creates a surface for indirect prompt injection where malicious instructions embedded in these files could attempt to influence the agent. However, the risk is mitigated by the skill's architecture, which dispatches specialized sub-agents guided by a structuredconfidence-checklist.mdto perform targeted evaluations rather than blindly executing plan contents.
Audit Metadata