pflow-task-plan
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes task descriptions from an external
todo.mdfile via themdtodotool. Maliciously crafted tasks could attempt to influence the agent's planning logic through indirect prompt injection. - Ingestion points: Task titles and descriptions retrieved from the todo file (default
todo.md). - Boundary markers: No explicit delimiters or instructions are used to separate ingested task content from the agent's logic.
- Capability inventory: The skill has the capability to write files to the local system and execute bash scripts.
- Sanitization: Content is handled as literal text via quoted heredocs, but no semantic validation of the task's instructions is performed.
- [COMMAND_EXECUTION]: The skill's scripts execute the
mdtodocommand-line utility to query the current task and list surrounding tasks for context. - [SAFE]: The skill documentation explicitly mandates the use of quoted heredocs (
<<'__PFLOW_PLAN_EOF__') when saving plans to the filesystem. This is a critical security measure that prevents the shell from expanding or executing any commands or variables that might be present in the generated Markdown content, effectively neutralizing command injection attacks via the plan content.
Audit Metadata