astrofy-implementation-planner
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local specification files to generate implementation tasks, which could lead to unintended agent behavior if the input files contain malicious instructions.
- Ingestion points: The skill reads data from
page.mdandpage-spec.jsonto determine task content (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore potential commands embedded within the processed specifications.
- Capability inventory: The skill executes local CLI commands (
astrofy status,astrofy plan,astrofy apply) and uses task creation tools (astrofy-sitespec-create) that use parameters derived from the input data (SKILL.md). - Sanitization: There is no evidence of validation or sanitization of the values extracted from the page specifications before they are used in CLI arguments or file content.
- [COMMAND_EXECUTION]: The skill interacts with the local system by executing shell commands via the
astrofyCLI tool. While this is expected behavior for its primary purpose, the command arguments are derived from external files (page-spec.json), which could be manipulated to inject unexpected flags or values (SKILL.md, references/technical.md).
Audit Metadata