gsd-plan-phase
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources through several flags, including
--prd <file>,--ingest <path-or-glob>, and--reviews(which incorporates feedback fromREVIEWS.md). This content is parsed into the planning context to guide the behavior of the agent and the sub-agents it spawns. - Ingestion points: Requirements are read from files provided via the
--prdflag, decision records are ingested via the--ingestflag, and cross-AI reviews are read fromREVIEWS.mdwhen the--reviewsflag is used. - Boundary markers: The skill instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious embedded commands within these external documents.
- Capability inventory: The skill is granted access to high-impact tools such as
Bash,Write,Agent(for spawning sub-processes), andWebFetch(for research). - Sanitization: There is no mention of sanitization, filtering, or validation logic to ensure that instructions embedded within the ingested PRDs or reviews do not override the agent's primary workflow.
Audit Metadata