executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingest and follows instructions from external plan files, creating a surface where a malicious plan could attempt to redirect agent behavior.
- Ingestion points: Plan files are read from the workspace during the initialization phase (Step 1).
- Boundary markers: The skill lacks explicit instructions to treat plan content as untrusted data or to utilize delimiters to prevent instruction confusion.
- Capability inventory: The agent is authorized to execute arbitrary implementation tasks, run verifications, and manage git branches, which could be abused if the plan source is compromised.
- Sanitization: No validation or sanitization of plan content is performed prior to the agent attempting to execute the tasks.
- [COMMAND_EXECUTION]: The core process requires the agent to execute tasks and verifications from the plan, which typically involves running shell commands, build scripts, and test suites in the local environment.
Audit Metadata