look-ahead-planner
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches weather forecasts from external APIs such as OpenWeather or NOAA using project coordinates to inform activity planning.\n- [EXTERNAL_DOWNLOADS]: The generated HTML output references the Chart.js library via the jsDelivr CDN to provide project visualizations.\n- [PROMPT_INJECTION]: The skill ingests untrusted data from various project management logs which creates an indirect prompt injection surface where maliciously formatted data could influence agent behavior.\n
- Ingestion points: Data is read from project-specific files including
schedule.json,procurement-log.json,directory.json,specs-quality.json, andinspection-log.json.\n - Boundary markers: The workflow does not explicitly utilize delimiters or "ignore" instructions to isolate untrusted data from the agent's core instructions.\n
- Capability inventory: The skill has the ability to perform network requests, write files to the local system, and generate interactive HTML with embedded JavaScript.\n
- Sanitization: No validation or sanitization of the content extracted from project data logs is documented in the workflow.
Audit Metadata