he-plan
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user requirements and repository content to generate planning documents. While this represents a surface for indirect prompt injection where malicious instructions could be embedded in data, the skill includes explicit guidelines for publication privacy and readiness checks to mitigate accidental execution of untrusted instructions.
- [DYNAMIC_EXECUTION]: The Wayfinding methodology (referenced in
wayfinding.md) suggests the creation of "runnable" logic prototypes and "throwaway code" to resolve technical uncertainties. This involves generating and running code in a development context, which is standard practice for the skill's intended engineering purpose. - [EXTERNAL_DOWNLOADS]: The skill contains a documentation reference to a GitHub repository (
mattpocock/skills) as the source of its planning methodology. This is a static attribution link for reference purposes and does not represent an automated remote script execution or download vector.
Audit Metadata