theory-vs-reality
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute "retrieval recipes" to obtain the source plan, which can include arbitrary shell commands (e.g.,
aaa ralph subtasks list). Additionally, Stage 4 uses theopenorxdg-opencommands to automatically launch the generated HTML report. - [DATA_EXPOSURE]: In Stage 2, subagents are explicitly directed to "hunt the repo" for credentials needed for testing and to "name the seed user / file where it's defined." This encourages the identification and exposure of sensitive credential locations within the codebase.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (plans, stories, or tasks) which is then used to coordinate subagent verification tasks. Maliciously crafted input could attempt to manipulate the subagents' findings or verification steps.
- Ingestion points: Stage 0 accepts direct text pastes, file paths, and output from retrieval commands.
- Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are specified for the subagents processing the plan items.
- Capability inventory: The skill possesses shell execution capabilities (Stage 0 and 4), extensive file system read access (Stage 2), and file system write access (Stage 3).
- Sanitization: The skill does not describe any sanitization or validation logic for the input plan data or the commands identified during the recipe discovery phase.
Audit Metadata