planned-task-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that mandate the suppression of agent output. Specifically, the sections 'Silence after spawning tasks' and 'Checkpoint follow-up' instruct the agent to 'do not write any text', 'Do NOT summarize the plan', and 'do not write a user-facing message'. While these instructions are intended to avoid redundancy in the platform's UI, they technically constitute instructions to conceal actions and status from the user.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external payloads from background tasks and follow-up turns, which represents an injection surface.
- Ingestion points: Data is ingested via
<planned-task-follow-up>,<background-task-completed>, and<running-tasks>tags in the SKILL.md instructions. - Boundary markers: The skill relies on XML-like tags as delimiters for external data.
- Capability inventory: The skill has access to sensitive capabilities including
workflows(action="setup"),executions(action="run"),build-workflow, andtask-control. - Sanitization: The skill explicitly discourages sanitization or verification against the model's internal knowledge, stating 'Do not substitute values from conversation history or training priors' and 'Never trust builder prose'. This pattern increases the likelihood that a malicious payload in a task 'result' field would be treated as authoritative and potentially influence downstream tool calls.
Audit Metadata