executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions create a workflow that ingests untrusted data from an external "plan file" and directs the agent to "Follow each step exactly".
- Ingestion points: Step 1 specifies reading an external file containing an implementation plan.
- Capability inventory: The skill directs the execution of arbitrary steps defined in the plan, which may involve any capabilities the agent possesses (file modification, command execution, tool use, etc.).
- Boundary markers: The skill lacks explicit instructions to treat the plan content as untrusted or to ignore embedded system-level instructions.
- Sanitization: No data sanitization, schema validation, or escaping logic is defined for the plan content.
- Mitigating instructions: The skill includes human-in-the-loop checkpoints ("Review critically", "identify any questions or concerns", "Ready for feedback") and explicit instructions to "STOP executing immediately" when instructions are unclear or dependencies are missing, which serves to reduce the risk of accidental obedience to malicious instructions.
Audit Metadata