gsd-plan-phase
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it ingests untrusted external data to drive automated planning and execution workflows.
- Ingestion points: Untrusted data enters the agent's context through files provided via the
--prd <file>and--ingest <path-or-glob>arguments inSKILL.md. These files are used to populate the project context. - Boundary markers: The instructions do not define explicit delimiters or warnings to the agent to ignore instructions that might be embedded within the ingested PRD (Product Requirement Document) or ADR (Architecture Decision Record) files.
- Capability inventory: The skill has access to powerful tools across its workflow, including
Writefor file creation,Bashfor command execution, and theAgenttool to delegate tasks to a secondary planner or researcher. - Sanitization: There is no evidence of content sanitization or validation for the data ingested from external files before it is interpolated into the planning context (
CONTEXT.md) and passed to downstream agents.
Audit Metadata