recipe-front-plan
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests untrusted design documents and PRDs, then interpolates this data into prompts for subagents, creating a vulnerability surface where malicious instructions in the input files could manipulate agent behavior.
- Ingestion points: The skill reads design documents from
$ARGUMENTSordocs/design/(SKILL.md, Step 1) and PRD paths (SKILL.md, Step 2). - Boundary markers: There are no explicit boundary markers or delimiters defined in the execution protocol to isolate untrusted content when passed to the subagents.
- Capability inventory: The skill possesses the capability to invoke subagents for generating code skeletons (
acceptance-test-generator) and creating implementation plans (work-planner). - Sanitization: The skill lacks any explicit sanitization, validation, or instruction-filtering logic for the external content before it is processed.
Audit Metadata