ae-generate-tracking-plan
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes shell commands via the
ae-clitool (e.g.,ae-cli tracking plan draft,ae-cli auth login,ae-cli tracking plan upload). These commands incorporate user-provided inputs such as file paths, project IDs, and scenario descriptions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including product documents (PDF, DOCX, Markdown), image files, URLs, and source code, to extract business logic. This ingestion surface is vulnerable to embedded malicious instructions that could influence agent behavior. 1. Ingestion points:
meta.source_type(prd, codebase, URL, attachments) in Phase 0. 2. Boundary markers: None explicitly defined for untrusted content interpolation. 3. Capability inventory: File reads, file writes (draft.json, draft.xlsx), shell execution (ae-cli), and network uploads. 4. Sanitization: Naming convention checks and AE rule validation are performed on output, but no explicit sanitization of input document content is mentioned. - [EXTERNAL_DOWNLOADS]: The skill supports fetching content from arbitrary URLs provided by the user during the 'Anchor' phase to extract tracking requirements.
- [DATA_EXFILTRATION]: The workflow involves reading local business requirements and project structure, then uploading a tracking plan to a remote AE host. This establishes a data transfer path from the local environment to an external server.
Audit Metadata