rai-planner
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill instructs the agent to execute a local script using
npm run rai:sign -- -ProjectSlug {slug}inreferences/backlog-handoff.md. The{slug}variable is interpolated from the session state, which represents a potential command injection surface if the project slug is not validated. - Indirect Prompt Injection: The skill processes user-provided descriptions of AI systems to generate planning artifacts, creating a surface for instructions embedded in that data to influence agent behavior.
- Ingestion points: User interviews and system descriptions are gathered as described in
references/capture-coaching.md. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the reference guidance.
- Capability inventory: The skill performs file system read/write operations for assessment documents and executes shell commands for artifact signing as described in
references/backlog-handoff.md. - Sanitization: There is no explicit requirement or mention of sanitization or validation of the input data before it is used in documentation or command arguments.
Audit Metadata