plan
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and trusts data from external project files to influence its planning logic.
- Ingestion points: Reads contents from
.memplan/memory/failures.mem,.memplan/risk.mem,.memplan/memory/entities.mem, and.memplan/decisions/log.mem(Phase 1, SKILL.md). - Boundary markers: Absent. The data is read directly into the context without delimiters or instructions to ignore embedded commands.
- Capability inventory: Command execution via
nodeand file system modification through thememplan-cli.jsutility (Phase 3, SKILL.md). - Sanitization: None. The skill does not validate or sanitize the input from the local memory files before using it to draft steps.
- [COMMAND_EXECUTION]: The skill executes a local CLI tool using the command
node "$CLAUDE_PLUGIN_ROOT/bin/memplan-cli.js" plan-write .. While this is part of the intended functionality, it involves executing a script based on a path defined by an environment variable.
Audit Metadata