review
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes content from plan files located in the
.rcs/plans/directory. While this constitutes an ingestion point for potentially untrusted data that could attempt to influence the Critic agent's evaluation (indirect prompt injection), the skill does not possess sensitive capabilities like network exfiltration or shell execution that could be exploited. - Ingestion points: Reads files from
.rcs/plans/or user-specified paths in SKILL.md. - Boundary markers: None explicitly defined in the skill body; evaluation logic is deferred to the Critic agent.
- Capability inventory: No network operations, file-write permissions, or subprocess execution capabilities are present.
- Sanitization: Not present; the skill relies on the Critic agent's internal logic for evaluation.
- [COMMAND_EXECUTION]: The skill serves as a shortcut for invoking the
/plancommand with specific review flags. This is a functional requirement for its role as an operator-class tool and does not represent an unauthorized command execution risk.
Audit Metadata