loom-plan-execution
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the AO runtime and related .NET packages from well-known and vendor-controlled sources, including NuGet (api.nuget.org) and the author's GitHub repository (github.com/waynebaby/Techne-Loom). It utilizes SHA-512 verification sidecars to ensure package integrity before extraction.
- [REMOTE_CODE_EXECUTION]: By design, the skill downloads and executes binary components (dotnet ao.dll, ao.exe) to perform its primary function of plan orchestration. These operations are gated by a non-negotiable preflight and guide result verification step to ensure only governed runtimes are used.
- [COMMAND_EXECUTION]: The skill frequently invokes the .NET CLI and the AO runtime binaries to compile workflows, run objectives, and resume sessions. These commands are executed within a strict governance model that prioritizes business outcomes and audit continuity.
- [DYNAMIC_EXECUTION]: A dedicated subagent (loom-plan-execution-workflow-designer.agent.md) is used to dynamically generate and revise AO workflow JSON files. These generated scripts are then validated, compiled, and executed by the runtime orchestrator as part of the execution flow.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via plan_text and objective-file parameters. The ingestion process is secured through a mandatory evidence chain including ingestion points (objective-file), boundary markers (governance handoff points), capability inventory (binary execution), and sanitization (enforced schema validation and mandatory compile gates).
Audit Metadata