work-on-plan
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to locate and follow instructions from external plan files, which constitutes a surface for indirect prompt injection.
- Ingestion points: Files within the
docs/plans/directory and theAGENTS.mdfile as specified inSKILL.md. - Boundary markers: Absent. There are no delimiters or instructions to treat the ingested content as untrusted data.
- Capability inventory: The agent is tasked with 'working on the plan', which typically involves using its full range of available tools (e.g., file system access, code modification, command execution) to fulfill instructions found in those files.
- Sanitization: Absent. The agent is explicitly commanded to 'Follow the instructions in the plan' without any instruction to validate or sanitize the content.
Audit Metadata