st-create-plan
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and follows instructions from external Markdown files such as
PRE_PLAN.mdandPOST_PLAN.mdlocated in the workspace configuration directory. - Ingestion points:
SKILL.mddirects the agent to read context and follow instructions from configuration files in<root>/config/hooks/and<root>/config/shared/. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this external content as untrusted or to ignore embedded instructions.
- Capability inventory: The skill can write files and execute local JavaScript helper scripts.
- Sanitization: There is no evidence of sanitization or validation of the content within these configuration files before they are processed as instructions.
- [COMMAND_EXECUTION]: The skill executes local JavaScript scripts (
scripts/find-strikethroo-root.cjs,scripts/check-for-updates.cjs, andscripts/get-next-plan-id.cjs) to manage workspace discovery, versioning, and plan ID allocation. These are standard operations for the skill's management of its own environment.
Audit Metadata