slice
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads task descriptions from
PLAN.mdand treats them as instructions for implementation and execution. - Ingestion points: The skill reads the
PLAN.mdfile in the first step to identify the task to be performed. - Boundary markers: The instructions lack delimiters or specific warnings to prevent the agent from obeying instructions embedded within the task descriptions.
- Capability inventory: The skill is capable of modifying the filesystem to implement code (step 2), executing shell commands to "run the app" (step 3), and performing git operations to commit changes (step 4).
- Sanitization: There is no process defined to validate or sanitize the input from the plan file before the agent acts upon it.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands to "run the app and the relevant checks" as part of its verification process in step 3. While this is necessary for its stated purpose, it provides an execution path for code generated or influenced by the untrusted plan file.
Audit Metadata