plan-session
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from project files (CLAUDE.md, TODOS.md), git history (git log, git diff), and user responses via AskUserQuestion. While it lacks explicit boundary markers for this data, the risk is mitigated by the skill's limited capabilities (writing markdown documents) and a hard gate prohibiting code execution.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute git commands for context gathering. These are restricted to local metadata retrieval and do not involve privileged system operations.
- [EXTERNAL_DOWNLOADS]: The skill uses WebSearch for landscape analysis. It follows safety best practices by requiring user consent before searching and instructing the agent to use generalized terms to protect user privacy.
Audit Metadata