Plan Review
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The README.md directs users to install from 'smith-horn/plan-review-skill', while the plugin.json metadata identifies the source as 'wrsmith108/plan-review-skill'. This inconsistency in the repository handle is deceptive and may lead users to install the skill from an unofficial or unverified source.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents such as implementation plans and architecture proposals, which could contain embedded malicious instructions designed to hijack the behavior of the review subagents (VP Product, VP Engineering, VP Design).\n
- Ingestion points: Untrusted document content is read from local files and passed to subagents using the Task tool.\n
- Boundary markers: The agent-prompt.md utilizes simple text labels like 'Plan: [PLAN_CONTENT]' to wrap user data, which does not provide robust isolation against instruction injection.\n
- Capability inventory: The coordination agent and subagents have access to file system tools (Read, Grep, Glob, Edit, Write) and communication tools (AskUserQuestion).\n
- Sanitization: No content sanitization is performed on the plan text, though the risk is mitigated by a mandatory user approval step via AskUserQuestion before any filesystem changes are executed.
Audit Metadata