st-create-plan
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from multiple project-specific files such as
config/hooks/PRE_PLAN.md,config/shared/clarification-gate.md, andconfig/shared/anti-rationalization.md. These files are treated as instructions for the agent's operating procedure. - Ingestion points: Files located at
<root>/config/hooks/PRE_PLAN.md,<root>/config/shared/clarification-gate.md, and<root>/config/shared/anti-rationalization.md(SKILL.md). - Boundary markers: None. The skill instructs the agent to "read and execute the instructions it contains" without explicit isolation or validation of that content.
- Capability inventory: The skill has the capability to execute local scripts (
scripts/find-strikethroo-root.cjs,scripts/get-next-plan-id.cjs) and write files to the local file system (SKILL.md). - Sanitization: None observed for the markdown content read from the configuration files.
- [COMMAND_EXECUTION]: The skill executes local JavaScript files using Node.js to determine workspace roots and plan IDs. While these scripts are part of the skill package, they perform file system operations based on the current working directory.
- Evidence: Execution of
scripts/find-strikethroo-root.cjsandscripts/get-next-plan-id.cjsin SKILL.md steps 1 and 5.
Audit Metadata