write-plan-consult

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to spawn subagents and make MCP calls to external LLMs (Gemini, OpenAI/Codex). It includes specific instructions for execution such as 'Spawn TWO parallel subagents' and 'Call mcp__consult-llm__consult_llm'.
  • [INDIRECT_PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect injection. It ingests responses from external models (Phase 2 and Phase 5) and incorporates them into a synthesized 'Phase 3: Plan'. If the external model returns malicious instructions wrapped in code or text, the planning process could be poisoned. The 'Self-referential' risk exists as the AI is trained to evaluate and act on external inputs during the planning cycle.
  • [DYNAMIC_EXECUTION]: The skill aims to generate concrete code snippets and file modification plans. While Phase 3 generates text/markdown, the intended final state is the creation and modification of files (exact/path/to/file.py), effectively generating executable content at runtime from external inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 07:00 PM
Security Audit — agent-trust-hub — write-plan-consult