plan-arbiter
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process untrusted external data, which introduces a risk of indirect prompt injection attacks.
- Ingestion points: As defined in
SKILL.md, the skill accepts inputs from "pasted text, local files, session IDs, transcript paths, PRs, comments, visual-plan links, or chat history." - Boundary markers: The instructions do not specify any delimiters (e.g., XML tags or specific markdown headers) or provide instructions for the agent to ignore command-like content inside the plans it processes.
- Capability inventory: The skill possesses file-read capabilities and can spawn subagents. Additionally, it can transition from planning to implementation ("proceed with the selected plan") if user approval is granted, potentially leading to unauthorized file modifications if the plan was manipulated.
- Sanitization: There are no mechanisms described for sanitizing, filtering, or escaping instructions embedded within the plan sources.
Audit Metadata