build

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and executing tasks defined in external plan files.
  • Ingestion points: Reads and parses implementation plans from the docs/plan/ directory (identified in Phase 0 of SKILL.md).
  • Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" warnings for the content of the plan files.
  • Capability inventory: The skill is capable of file system writes (Phase 2), package installation (Gotchas), shell command execution (Phase 4), and opening pull requests via /create-pr skip-checks.
  • Sanitization: There is no mention of escaping, validating, or filtering the instructions provided within the plan files before execution.
  • [COMMAND_EXECUTION]: The skill performs dynamic command execution and package management based on instructions from the ingested plan.
  • Evidence: The "Gotchas" section explicitly instructs the agent to install packages or dependencies referenced in the plan if they are missing.
  • Context: While intended for legitimate build automation, this allows the execution of installation commands derived from untrusted plan content.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 01:26 PM
Security Audit — agent-trust-hub — build