plan-readiness-review
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources such as PRDs, RFCs, and design documents, creating a surface for indirect prompt injection attacks.
- Ingestion points: The
SKILL.mdfile explicitly mentions "Artefacts under review (paths, doc URLs, ticket IDs)" and "planning artefacts" as primary inputs for analysis. - Boundary markers: The instructions lack explicit boundary markers or instructions to treat data as non-executable. While Phase 0 defines the scope, it does not provide delimiters to separate document content from agent instructions.
- Capability inventory: The skill includes high-level analytical capabilities and instructs the agent to "rewrite the plan text itself" when fixing issues. A successful injection could leverage this write capability to modify files or subvert the review process.
- Sanitization: There are no instructions for the agent to sanitize, filter, or ignore potentially malicious natural language instructions embedded within the design documents it analyzes.
Audit Metadata