plan-ledger-tasks-yylo
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is configured to use shell directives (
enable-shell-directives: true) and performs operations using theyyCLI tool, specifically theledgerandartifactcommand groups, to manage project tasks and local records. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes untrusted data from external project instructions and product code to generate tasks and requirements. This creates a vulnerability surface where instructions embedded in the code or project files could potentially influence the agent's actions when executing CLI commands.
- Ingestion points: Reads project instructions and product code from the integration or feature worktree (Step 1 in SKILL.md).
- Boundary markers: None identified in the instructions to separate untrusted data from agent instructions.
- Capability inventory: Executes shell commands via the
yyCLI for ledger management and artifact creation. - Sanitization: No sanitization, escaping, or validation of the ingested content is specified before it is used to produce Product Development Requirements (PDR) or task bodies.
Audit Metadata