executing-plans
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to read and execute instructions from external plan files, which presents a surface for indirect prompt injection attacks.
- Ingestion points: The workflow explicitly ingests external data in
SKILL.md(Step 1: "Read plan file"). - Boundary markers: The instructions include a manual review step ("Review critically"), but they lack technical boundary markers, delimiters, or specific instructions to disregard malicious directives that might be embedded within the plan content.
- Capability inventory: Upon loading a plan, the agent is authorized to "Execute all tasks" and "Run verifications," which may involve file system modifications or command execution depending on the plan's contents.
- Sanitization: There are no defined mechanisms for sanitizing or validating the plan's content before the agent begins implementation.
Audit Metadata