plan-review
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The workflow in SKILL.md instructs the agent to execute a shell command (node -e) using a here-document (<<) to pass the planText variable. As the skill documentation notes that plan text often originates from untrusted sources, an attacker could include the heredoc delimiter within the text to terminate the input and execute arbitrary shell commands.
- [DYNAMIC_EXECUTION]: The security of the shell execution is dependent on the agent's ability to follow complex runtime instructions to generate a non-colliding random delimiter. Entrusting an AI agent with the implementation of low-level shell security controls is an unreliable and high-risk pattern.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill requires several external scripts for its core operation and security checks, such as scripts/security-redact.js, scripts/lib/review-dispatch.js, and scripts/validate-family-sentinel.js. These scripts are not provided in the skill files, constituting unverifiable dependencies that are critical to the skill's security functions.
Recommendations
- AI detected serious security threats
Audit Metadata