executor
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external
PLAN.mdfiles and project code as instructions, creating a surface for injection attacks.\n - Ingestion points: Processes
PLAN.md,.gsd/STATE.md, and files specified in the plan's context section.\n - Boundary markers: The skill lacks explicit sanitization or delimiters for external content, though it includes a checkpoint system (Rule 4) for significant architectural changes.\n
- Capability inventory: Includes the ability to execute shell commands (e.g., Git), modify source code, and perform autonomous fixes (Rules 1-3).\n
- Sanitization: No explicit sanitization or escaping of external content before interpolation or processing is documented.\n- [COMMAND_EXECUTION]: The skill executes shell commands for version control and environment interaction.\n
- Evidence: Uses
git add,git commit, andgit logto manage project state. Examples also show execution ofvercelCLI commands for deployment.\n- [DYNAMIC_EXECUTION]: The skill is instructed to modify code autonomously based on task requirements and deviation rules.\n - Evidence: Deviation Rules 1, 2, and 3 explicitly authorize the agent to fix bugs, add functionality (e.g., security protections), and resolve blockers without seeking user permission. While intended for productivity, this grants the agent autonomous write access to the codebase.
Audit Metadata