plan-plus
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the local project environment that could potentially contain untrusted instructions.
- Ingestion points: Phase 0 automatically reads project files (CLAUDE.md, package.json, pom.xml) and the last 5 git commits.
- Boundary markers: The instructions do not specify explicit delimiters or "ignore instructions" wrappers for the ingested file content.
- Capability inventory: The skill has access to
Bash,Write,Edit, andTaskCreatetools. - Sanitization: There is no explicit sanitization step for the content read from files or git history before it is processed by the agent.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses project configuration and internal state files to inform the planning process.
- Evidence: Phase 0 reads
package.json,pom.xml, and.bkit-memory.json. - Context: Access is limited to the local file system using the
Readtool, and the data is used to generate internal planning documents.
Audit Metadata