archive-planning
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected. The skill uses local scripts to move files, which is consistent with its stated purpose of archiving planning documents.
- [COMMAND_EXECUTION]: The skill executes a local Python script bundled with the skill. The script uses standard libraries to handle file management and directory creation.
- [PROMPT_INJECTION]: The skill extracts directory names from project files, creating a potential surface for indirect prompt injection.
- Ingestion points:
task_plan.mdandfindings.mdare read by the script to infer feature names. - Boundary markers: No explicit markers are used to delimit the extracted content.
- Capability inventory: The script performs directory creation and file movement using
pathlibandshutil. - Sanitization: The
slugifyfunction inarchive_planning.pyuses a regex to remove invalid characters (e.g., control characters and path delimiters), effectively preventing directory traversal or manipulation of the archive location.
Audit Metadata