executing-plans
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and execute instructions from a external "plan file" (Step 1). If an attacker can influence the content of this file, they could potentially inject malicious instructions that the agent would follow as part of the implementation process.
- Ingestion points: The agent reads a plan file from the local filesystem as part of Step 1.
- Boundary markers: The skill lacks explicit instructions or markers to distinguish between trusted execution instructions and potentially untrusted content within the plan file.
- Capability inventory: The skill provides instructions for the agent to follow tasks (which typically involve code changes) and run verifications (which involve shell command execution).
- Sanitization: There is no mention of content validation or sanitization for the instructions found in the plan file.
Audit Metadata