archive-planning

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: No security issues were detected. The skill uses local scripts to move files, which is consistent with its stated purpose of archiving planning documents.
  • [COMMAND_EXECUTION]: The skill executes a local Python script bundled with the skill. The script uses standard libraries to handle file management and directory creation.
  • [PROMPT_INJECTION]: The skill extracts directory names from project files, creating a potential surface for indirect prompt injection.
  • Ingestion points: task_plan.md and findings.md are read by the script to infer feature names.
  • Boundary markers: No explicit markers are used to delimit the extracted content.
  • Capability inventory: The script performs directory creation and file movement using pathlib and shutil.
  • Sanitization: The slugify function in archive_planning.py uses a regex to remove invalid characters (e.g., control characters and path delimiters), effectively preventing directory traversal or manipulation of the archive location.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 04:49 PM
Security Audit — agent-trust-hub — archive-planning