planner
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data into persistent state files which are then used to drive a multi-agent workflow involving the Architect, Developer, and Technical Writer sub-agents.
- Ingestion points: User-provided context and task specifications are captured in
context.jsonduring Step 2 of the planning workflow, as described inINTENT.md. - Boundary markers: The
context.jsonandplan.jsonschemas provide structure but do not explicitly define boundary markers or instructions to treat user-provided text as data rather than instructions during sub-agent processing. - Capability inventory: The orchestration scripts invoke various sub-agents that have the capability to generate file diffs and documentation modifications. The skill uses the
invoketool to execute its primary Python logic. - Sanitization: The system uses Pydantic v2 for schema validation and includes internal reference integrity checks (
Plan.validate_refs()) to ensure the plan structure is valid before implementation. - [COMMAND_EXECUTION]: The skill utilizes the
invoketool inSKILL.mdto execute internal Python modules (skills.planner.orchestrator.plannerandskills.planner.orchestrator.executor) that manage the complex orchestration and sub-agent dispatching logic.
Audit Metadata