build
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and executing tasks defined in external plan files.
- Ingestion points: Reads and parses implementation plans from the
docs/plan/directory (identified in Phase 0 ofSKILL.md). - Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the content of the plan files.
- Capability inventory: The skill is capable of file system writes (Phase 2), package installation (Gotchas), shell command execution (Phase 4), and opening pull requests via
/create-pr skip-checks. - Sanitization: There is no mention of escaping, validating, or filtering the instructions provided within the plan files before execution.
- [COMMAND_EXECUTION]: The skill performs dynamic command execution and package management based on instructions from the ingested plan.
- Evidence: The "Gotchas" section explicitly instructs the agent to install packages or dependencies referenced in the plan if they are missing.
- Context: While intended for legitimate build automation, this allows the execution of installation commands derived from untrusted plan content.
Audit Metadata