writing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external specifications and requirements to generate implementation plans. This creates an attack surface where malicious instructions embedded in a spec could be translated into actionable tasks for the agent or subagents to execute.
- Ingestion points: Processes "spec or requirements" provided by the user or project context in
SKILL.md. - Boundary markers: The instructions lack specific delimiters or instructions to ignore potential commands embedded within the input specifications.
- Capability inventory: The skill is capable of writing files to the local directory (plans) and executing Git commands (
git worktree,git commit). - Sanitization: There is no evidence of sanitization or filtering for the input specifications.
- Mitigation: The skill includes a
plan-document-reviewer-prompt.mdtemplate designed to verify spec alignment and completeness, which acts as a secondary review gate to identify anomalies. - [COMMAND_EXECUTION]: The skill directs the agent to perform several shell-based operations, including directory probing, creating Git worktrees, and performing Git commits. It also generates implementation plans that include specific CLI commands for testing (e.g.,
pytest) and version control.
Audit Metadata