functional-planner
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill ingests untrusted Product Requirements Documents (PRDs) as part of its core functionality.
- Ingestion points: PRD source provided via path, folder, or explicit content (SKILL.md).
- Boundary markers: Includes an explicit 'Untrusted Content Boundary' that instructs the agent to treat PRD text as untrusted and prevents it from redirecting the workflow or triggering mutations (SKILL.md).
- Capability inventory: The skill is limited to read-only API calls for work-item discovery and field validation (e.g., mcp_github_list_issue_types). It explicitly prohibits all create, update, or transition operations during the planning phase (SKILL.md, references/github.md).
- Sanitization: All output content is sanitized based on conventions defined in the 'backlog-management' skill (SKILL.md).
- [Read-Only Boundary Enforcement]: The skill architecture enforces a strict planning-only boundary. It ensures that no modifications are made to target platforms like Azure DevOps, GitHub, or Jira until a separate execution pass is reviewed by a human, minimizing the risk of unauthorized changes.
- [Dependency Management]: The skill validates the presence of required external capabilities (like the 'backlog-management' and 'jira' skills) before execution. This prevents the agent from attempting to reimplement or guess command structures if a dependency is missing.
Audit Metadata