write-plan
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content from
spec.mdto generate tasks and waves. While this is the primary purpose of the skill, it lacks explicit sanitization or boundary markers to prevent the agent from following malicious instructions potentially embedded in the specification files. - Ingestion points: Reads project specification files (e.g.,
meta/specs/NNN-slug/spec.md) in Step 1 and Step 2. - Boundary markers: The protocol does not define delimiters or specific "ignore instructions" wrappers when processing the content of
spec.md. - Capability inventory: The skill uses shell commands (
grep,sed,git log,git diff) and performs file writes (plan.md) and Git operations (git commit,git add,git reset). - Sanitization: There is no explicit validation or filtering logic mentioned for the external content before it is processed or used to generate task descriptions.
Audit Metadata