ln-222-story-replanner
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection as its core workflow involves ingesting and analyzing untrusted external data in the form of existing stories from task providers.
- Ingestion points: Existing story content (including titles, descriptions, and acceptance criteria) is loaded from Linear or local markdown files during PHASE_2_LOAD_EXISTING_STORIES.
- Boundary markers: The instructions do not define strict boundary markers or include specific directives for the agent to ignore potentially malicious instructions embedded within the ingested story data.
- Capability inventory: The skill possesses the capability to execute local Node.js scripts, write to project files like kanban_board.md and docs/templates/, and perform updates to project management entities via the Linear API.
- Sanitization: No explicit sanitization or validation of the ingested story content is described before it is incorporated into the agent's context for comparison logic.
- [COMMAND_EXECUTION]: The skill architecture requires the execution of multiple local Node.js scripts located in references/scripts/ to manage its internal runtime, record checkpoints, and generate project summaries. These scripts perform routine file system operations (read/write/mkdir) within the project's .hex-skills/ directory and are essential for the skill's state management.
Audit Metadata