review-plan
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from 'plan.md', 'checklist.html', and 'research.md', which are external data sources that could contain malicious instructions designed to influence the agent's behavior during the review process. ● Ingestion points: The skill reads multiple files from the 'tmp/issues/' directory. ● Boundary markers: No delimiters or instructions to ignore embedded commands are specified for the ingested content. ● Capability inventory: The skill has 'Bash' execution, file read/write access, and 'Grep' capabilities. ● Sanitization: There is no mention of sanitizing identifiers or symbols extracted from these files before they are utilized.
- [COMMAND_EXECUTION]: The skill dynamically constructs 'grep' commands using identifiers and symbols extracted from the 'plan.md' file. This creates a potential surface for command injection if the input files contain malicious shell syntax or metacharacters that are interpreted by the Bash tool.
- [DATA_EXFILTRATION]: The skill accesses configuration files located at '~/.agents/.skills-config/review-plan/config.json'. While these are intended for project-specific instructions, the access to dot-files in the user's home directory represents a potential data exposure risk, although it is likely used for legitimate skill configuration.
Audit Metadata