plannotator-review
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as identified by the following evidence chain:
- Ingestion points: The skill ingests untrusted data from the worktree or external pull request URLs via the
plannotator reviewcommand. - Boundary markers: No explicit delimiters or instructions are provided to distinguish between valid feedback and malicious instructions embedded in the review annotations.
- Capability inventory: The skill has the capability to execute
plannotator:*commands and is instructed to "address" any feedback or annotations returned by the tool, allowing external content to influence the agent's actions. - Sanitization: There is no evidence of sanitization or validation of the tool's output before the agent processes and acts on it.
- [COMMAND_EXECUTION]: The skill executes the
plannotatorCLI tool through a Bash shell. This execution is scoped to the tool's namespace and is consistent with the skill's stated purpose of providing a code review interface.
Audit Metadata