plan
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from specification files located in
llmwiki/wiki/sources/draft/and processes them into execution plans for other agents. - Ingestion points: Reads
DDMMYY-<tên>.mdspecification files which can contain user-provided or external agent content. - Boundary markers: Absent. The instructions explicitly state to "chép nguyên văn" (copy verbatim) sections like context and constraints into the plan.
- Capability inventory: Reads and writes to the local filesystem (wiki and codebase) and executes orchestration commands via the
orcatool. - Sanitization: Absent. Content is passed verbatim to the
dispatch --injectcommand, allowing potentially malicious instructions in the source SPEC to influence downstream agent behavior. - [COMMAND_EXECUTION]: The workflow involves the execution of shell-level orchestration commands.
- Evidence: Step 8 of the main workflow executes
orca orchestration task-createanddispatch --injectusing content derived from the generated plan. This allows the skill to programmatically trigger actions in the agent environment.
Audit Metadata