qrspi-implement
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and follows instructions from an external file (
plan.md), which serves as the primary driver for the agent's actions. This creates a surface where malicious instructions embedded in the data could be executed. - Ingestion points: The agent reads
<path>/plan.mdas its primary working document (SKILL.md, Input and Process sections). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between valid task data and potential malicious instructions within the plan file.
- Capability inventory: The agent has the capability to modify arbitrary files in the codebase, execute shell commands for verification, and perform git commits.
- Sanitization: No sanitization or validation of the plan file's contents is specified before implementation or execution.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to "Execute the automated verification commands from the plan." This functionality allows for the execution of arbitrary shell commands defined in an external, potentially untrusted document.
Audit Metadata