plan-implementation
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from external sources to define its execution plan.
- Ingestion points: Data fetched from Linear issues (including status, labels, and parent relationships) and local repository
CONTEXT.mdfiles in Step 2. - Boundary markers: The instructions do not define delimiters or specific 'ignore embedded instructions' warnings when processing external data.
- Capability inventory: The agent possesses significant capabilities including modifying Linear issue states, posting comments to Linear, creating Git branches, performing commits, and opening Merge Requests.
- Sanitization: There is no mention of sanitizing or validating the content of issues or context files before they are incorporated into the plan and subsequently executed.
- [COMMAND_EXECUTION]: The skill performs cross-skill file access to load an 'execution contract'.
- Evidence: Step 3 instructs the agent to 'Silently read the implement skill (the SKILL.md in the implement folder beside this skill's own folder)'. While this is used to coordinate behavior between skills, it involves traversing the skill installation directory to access files outside its own immediate scope.
Audit Metadata