planning-with-files
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes start and stop hooks to execute local shell and PowerShell scripts (
check-complete.sh,check-complete.ps1) for task state verification. It also encourages the manual execution of a Node.js script (session-catchup.mjs) for context recovery. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its session recovery mechanism.
- Ingestion points: The
session-catchup.mjsscript reads conversation history from.jsonlfiles located in the~/.claude/projects/directory. - Boundary markers: The script uses simple text headers such as
--- UNSYNCED CONTEXT ---to delimit historical data, which may not prevent a model from following instructions embedded in the logs. - Capability inventory: The skill possesses extensive capabilities including
Bashexecution and file manipulation (Write,Edit,Read) across its various scripts and hooks. - Sanitization: The script performs basic JSON parsing and string slicing but lacks robust sanitization to filter out instruction-like content from the ingested session history.
Audit Metadata