write-plan-consult
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to spawn subagents and make MCP calls to external LLMs (Gemini, OpenAI/Codex). It includes specific instructions for execution such as 'Spawn TWO parallel subagents' and 'Call mcp__consult-llm__consult_llm'.
- [INDIRECT_PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect injection. It ingests responses from external models (Phase 2 and Phase 5) and incorporates them into a synthesized 'Phase 3: Plan'. If the external model returns malicious instructions wrapped in code or text, the planning process could be poisoned. The 'Self-referential' risk exists as the AI is trained to evaluate and act on external inputs during the planning cycle.
- [DYNAMIC_EXECUTION]: The skill aims to generate concrete code snippets and file modification plans. While Phase 3 generates text/markdown, the intended final state is the creation and modification of files (
exact/path/to/file.py), effectively generating executable content at runtime from external inputs.
Audit Metadata