plan-orchestrate

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to probe the local filesystem to determine the environment configuration. Specifically, it checks for the existence of directories in the user's home folder (e.g., ~/.claude/plugins/marketplaces/ecc/ and ~/.claude/agents/) and identifies project metadata files (e.g., package.json, pyproject.toml, go.mod) to automate formatting and language detection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided plan documents to generate automated task descriptions.
    • Ingestion points: The skill reads content from a file path provided by the user via the <plan-doc-path> argument.
    • Boundary markers: Instructions define a specific structure for output (e.g., [Plan: <path>#step-<id>] and 'Acceptance' criteria), but the skill does not include explicit delimiters or instructions for the agent to ignore potentially malicious directions embedded within the source plan document.
    • Capability inventory: The skill is designed to be generative only; it emits Markdown commands for user copy-pasting and is explicitly prohibited from invoking the /orchestrate tool or other execution tools itself.
    • Sanitization: The skill instructions include escaping double quotes within task descriptions to ensure the final emitted command string is valid.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 01:16 AM