business-plan-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow involves running a local script,
tools/release-gate/validate_release_bundle.py, to perform validation tasks. While this is a functional requirement for the business process, the execution of local scripts provides a capability that should be used with caution. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an orchestrator that ingests and processes data from multiple external documents and sources, creating a vulnerability surface for indirect instructions.
- Ingestion points: The skill reads engagement briefs, research evidence, and specialist work products from the workspace (SKILL.md, Workflow).
- Boundary markers: The instructions lack explicit boundary markers or delimiters to help the agent distinguish between input data and system instructions.
- Capability inventory: The skill possesses permissions to read/write files and execute local Python scripts (SKILL.md, Capability Contract).
- Sanitization: The workflow relies on conceptual audits and reviews (e.g., "anti-slop audit") rather than technical sanitization or escaping of external data.
Audit Metadata