light-plan-and-work
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions and associated reference documents define a processing surface for indirect prompt injection by ingesting external repository state and user-provided instructions.
- Ingestion points: User-provided task descriptions, project-level instructions, and existing repository files (SKILL.md).
- Boundary markers: The agent is instructed to lock a compact "execution brief" (Goal, Deliverable, Boundary, Acceptance) before execution and to "distinguish checks that directly cover the task from repository-wide or environment-wide gates" (SKILL.md).
- Capability inventory: The skill allows for direct file editing and shell-based verification commands (bash) as defined in the interface configuration (agents/interface.yaml).
- Sanitization: The skill implements a "Blocked verification protocol" in references/routing-and-verification.md, which requires the agent to classify failures using read-only evidence and compare failing paths against the task boundary before acting, effectively sanitizing the impact of potentially malicious data in unrelated files.
- [DATA_EXPOSURE]: No hardcoded credentials or data exfiltration patterns were identified. The verification matrix in the routing guidelines explicitly requires scanning for secrets and temporary files before publishing results, which is a recommended security practice.
- [REMOTE_CODE_EXECUTION]: No remote code execution or untrusted downloads were detected. The Python test suite (tests/test_contract.py) uses only standard library modules to verify skill consistency and structural integrity.
Audit Metadata