plan-mode-manager
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions in SKILL.md direct the agent to execute a local Python script located at
scripts/llmops_manager.py. The source code for this script was not provided in the skill package for verification. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data by incorporating user-defined project names, task descriptions, and strategies into command-line arguments. This creates a risk where malicious input could alter the agent's behavior or target the underlying execution environment.
- Ingestion points: Untrusted data enters the context through the
--name,--description,--task, and--projectarguments in the examples provided in SKILL.md. - Boundary markers: There are no explicit delimiters or system instructions defined to prevent the agent from following prompts embedded within the user-provided data.
- Capability inventory: The skill has the capability to execute code via the Python interpreter on the local file system.
- Sanitization: The instructions do not define any sanitization, escaping, or validation mechanisms for the user-provided input before it is used in shell commands.
Audit Metadata