executing-plans
Warn
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is instructed in Step 2 to parse a
json:metadatacode fence from task descriptions and execute theverifyCommandfound within. This allows for arbitrary command execution driven by the content of external plan or task files. - [REMOTE_CODE_EXECUTION]: Because the skill fetches and executes logic (verification commands and task steps) from external data sources (plan and
.tasks.jsonfiles), it creates an execution vector for untrusted content. - [PROMPT_INJECTION]: The skill exhibits an Indirect Prompt Injection surface (Category 8):
- Ingestion points: The skill reads external plan files and
.tasks.jsonfiles in Steps 0, 1, and 1b. - Boundary markers: There are no specified delimiters or instructions to prevent the model from obeying malicious instructions embedded in the task descriptions, goals, or metadata.
- Capability inventory: The agent has access to
TaskCreate,TaskUpdate, and general shell execution via theverifyCommandinstruction. - Sanitization: No validation or sanitization of the content parsed from these external files is performed before it is used to influence the agent's implementation tasks.
Audit Metadata