plan-feature
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because user-supplied input ($ARGUMENTS) is directly interpolated into instructions for multiple sub-agents without sanitization or protective boundary markers.
- Ingestion points: The feature description provided by the user in $ARGUMENTS is used to populate prompts for sub-agents in Phase 1 (Research) and Phase 3 (Critique).
- Boundary markers: None. The skill explicitly instructs to replace placeholders with the "exact $ARGUMENTS value," failing to use delimiters (like triple backticks or XML tags) that could help sub-agents distinguish between developer instructions and user-provided data.
- Capability inventory: The skill requests high-privilege permissions via allowed-tools, including Bash, Agent, WebSearch, and WebFetch, which could be abused if a sub-agent is successfully hijacked.
- Sanitization: There is no logic to validate, filter, or escape the feature description to prevent it from containing malicious instructions targeted at the sub-agents.
- [NO_CODE]: This skill consists entirely of markdown instructions (SKILL.md) and does not include any accompanying scripts or executable files.
Audit Metadata