plan-for-goal
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements a
PostToolUsehook inSKILL.mdthat automatically triggers the execution of a Python script (skill-event.py) usingpython3whenever a tool is used. - [DATA_EXFILTRATION]: The automated hook transmits telemetry data, such as skill activation events and harness information, to a local script. Additionally, the skill provides a manual feedback command for users to submit ratings and text-based comments.
- [EXTERNAL_DOWNLOADS]: The documentation in
references/self-verification-tools.mdreferences several external UI automation tools hosted on GitHub, including repositories from Vercel Labs (a well-known service), Callstack Incubator, and CUA. - [INDIRECT_PROMPT_INJECTION]: The skill processes the current conversation history to generate complex instructions, which constitutes a potential surface where malicious data in the conversation could influence the synthesized prompt.
- Ingestion points: Conversation history is used as the primary input for prompt generation in
SKILL.md. - Boundary markers: No explicit delimiters or boundary markers are defined to isolate the ingested conversation content.
- Capability inventory: The skill executes local Python scripts for tracking and feedback purposes.
- Sanitization: The instructions do not specify any sanitization or validation of the input conversation data before processing.
Audit Metadata