implement
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user requests and external plan files to drive its implementation and verification logic without explicit sanitization.
- Ingestion points: SKILL.md (Step 2, 3, and 4) ingest instructions from the user request, plan files, and prior task descriptions.
- Boundary markers: Absent. There are no defined delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The skill utilizes file editing tools (grep/write), goal management tools (create_goal/update_goal), and arbitrary command execution capabilities.
- Sanitization: Absent. The agent is instructed to directly execute the logic described in the external context.
- [COMMAND_EXECUTION]: Step 4 (Run Verification) instructs the agent to execute arbitrary commands, smoke checks, or MCP tool invocations specified in the conversation context. This creates a direct path for instructions in a plan file or user request to execute code on the host system.
Audit Metadata