plan-to-implementation
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitHub PR comments and issue titles to create implementation plans, presenting an indirect prompt injection attack surface. Ingestion points: Data is pulled from GitHub issue comments and PR descriptions as seen in rehydrate-and-finish.md. Boundary markers: The skill employs and markers to delimit the plan content, providing a structural boundary. Capability inventory: The skill has broad capabilities including git worktree creation, PR state management (ready/close), and branch deletion, and it delegates plan execution to a sub-agent as described in SKILL.md. Sanitization: The extraction process is mechanical and lacks sanitization or validation of the plan's instructions before they are passed to the sub-agent.
Audit Metadata