rpi-implement
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests instructions and verification commands from external markdown "plan" files (e.g., in
docs/agents/plans/). This creates a vulnerability where a malicious plan file could trick the agent into executing unauthorized shell commands or making unintended code changes. - Ingestion points: Markdown files in
docs/agents/plans/or user-provided paths. - Boundary markers: Absent. The skill lacks instructions to distinguish between legitimate plan data and potentially malicious embedded instructions.
- Capability inventory: The skill has file-write permissions to the codebase (task tracking) and shell execution capabilities for verification checks (success criteria).
- Sanitization: Absent. There is no validation or filtering of the commands extracted from the plan files.
- [COMMAND_EXECUTION]: The instructions explicitly direct the agent to run "success criteria checks" which include "test commands". This facilitates the execution of shell commands provided via external data files.
Audit Metadata