executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and executes instructions from an external plan file, which represents a potential ingestion point for untrusted data.
- Ingestion points: The 'Read plan file' step in SKILL.md.
- Boundary markers: None specified beyond the instruction to 'Review critically'.
- Capability inventory: Implementation tasks involve file system access and shell command execution.
- Sanitization: No specific sanitization or escaping of the plan content is mentioned.
- [SAFE]: The skill mandates isolated git worktrees for development tasks and explicitly prohibits implementation on the main branch without user consent, which are considered best practices for secure development workflows.
Audit Metadata