doc-iplan
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing external data into executable instructions.
- Ingestion points: The skill ingests untrusted data from upstream SPEC and TDD documents (e.g., files referenced via
@specand@tddtags). - Boundary markers: The instructions do not define boundary markers or delimiters to isolate content from upstream documents, nor do they instruct the agent to ignore embedded instructions within that data.
- Capability inventory: The skill's primary output is an IPLAN document containing
execution_commands(runnable bash scripts) and afile_manifestfor file creation/modification. - Sanitization: There is no evidence of sanitization, validation, or filtering of the upstream content before it is interpolated into the generated bash commands.
- [COMMAND_EXECUTION]: The skill explicitly instructs the agent to generate and include "runnable bash" commands for setup, implementation, and validation within the produced IPLAN artifacts. While this is the intended purpose of the skill, it creates a mechanism for executing shell commands based on design documentation.
Audit Metadata