plan-orchestrate
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to probe the local filesystem to determine the environment configuration. Specifically, it checks for the existence of directories in the user's home folder (e.g.,
~/.claude/plugins/marketplaces/ecc/and~/.claude/agents/) and identifies project metadata files (e.g.,package.json,pyproject.toml,go.mod) to automate formatting and language detection. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided plan documents to generate automated task descriptions.
- Ingestion points: The skill reads content from a file path provided by the user via the
<plan-doc-path>argument. - Boundary markers: Instructions define a specific structure for output (e.g.,
[Plan: <path>#step-<id>]and 'Acceptance' criteria), but the skill does not include explicit delimiters or instructions for the agent to ignore potentially malicious directions embedded within the source plan document. - Capability inventory: The skill is designed to be generative only; it emits Markdown commands for user copy-pasting and is explicitly prohibited from invoking the
/orchestratetool or other execution tools itself. - Sanitization: The skill instructions include escaping double quotes within task descriptions to ensure the final emitted command string is valid.
- Ingestion points: The skill reads content from a file path provided by the user via the
Audit Metadata