work-on-plan
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it explicitly directs the agent to locate external files and follow the instructions contained within them.
- Ingestion points: The agent is instructed to read content from the
docs/plans/directory (specifically looking for folders with numeric prefixes) and theAGENTS.mdfile. - Boundary markers: Absent. The skill lacks instructions or delimiters that would prevent the agent from executing malicious commands embedded within a plan file.
- Capability inventory: As the skill directs the agent to "Follow the instructions in the plan," the agent's full suite of capabilities (such as shell execution, file modification, and network access) is exposed to the content of these external files.
- Sanitization: Absent. There is no logic provided to validate, filter, or escape the content retrieved from the plans before the agent processes it as instructions.
Audit Metadata