executing-plans

Warn

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is instructed in Step 2 to parse a json:metadata code fence from task descriptions and execute the verifyCommand found within. This allows for arbitrary command execution driven by the content of external plan or task files.
  • [REMOTE_CODE_EXECUTION]: Because the skill fetches and executes logic (verification commands and task steps) from external data sources (plan and .tasks.json files), it creates an execution vector for untrusted content.
  • [PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface (Category 8):
  • Ingestion points: The skill reads external plan files and .tasks.json files in Steps 0, 1, and 1b.
  • Boundary markers: There are no specified delimiters or instructions to prevent the model from obeying malicious instructions embedded in the task descriptions, goals, or metadata.
  • Capability inventory: The agent has access to TaskCreate, TaskUpdate, and general shell execution via the verifyCommand instruction.
  • Sanitization: No validation or sanitization of the content parsed from these external files is performed before it is used to influence the agent's implementation tasks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 16, 2026, 03:45 PM
Security Audit — agent-trust-hub — executing-plans