plan-forge
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources.
- Ingestion points: In
SKILL.md(Step 0), the skill uses theghCLI to fetch issue titles, bodies, and comments, which are controlled by external users. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the fetched issue content as untrusted or to ignore embedded instructions within that content.
- Capability inventory: The ingested data is used to generate a "locked" execution plan and an implementation prompt (as seen in
references/impl-prompt-template.md). This prompt then drives a subagent which has significant capabilities, including executinggitcommands andmakebuild scripts. - Sanitization: The skill does not mention any sanitization or validation of the issue content before it is incorporated into the plan and implementation prompt.
- [COMMAND_EXECUTION]: The skill instructs the agent to invoke external command-line tools using parameters derived from untrusted issue data.
- Evidence: In
SKILL.md(Step 3), the agent is instructed to use `obsidian create name="Plans/YYYY-MM-DD - "
. The` placeholder is typically derived from the issue title. If the platform's tool execution environment does not properly sanitize shell metacharacters in these arguments, an attacker could potentially achieve command injection through a malicious GitHub issue title.
Audit Metadata