plannotator-setup-goal

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill's primary function is to organize project goals by creating a directory structure and markdown templates locally. File operations are restricted to the project's goals/ directory and do not involve sensitive system files or network exfiltration.\n- [COMMAND_EXECUTION]: The skill executes a bundled Python script (scaffold_goal.py) and an external CLI tool (plannotator) to manage and review documentation. These actions are within the expected scope of a project management tool and use sanitized inputs (e.g., slugification) to prevent command injection.\n- [PROMPT_INJECTION]: The skill incorporates user-provided objectives into document templates. However, the workflow enforces a human-in-the-loop security control via the plannotator annotate --gate command, which ensures that a user reviews and approves all generated content before it is finalized or used as a prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 02:59 AM
Security Audit — agent-trust-hub — plannotator-setup-goal