st-refine-plan
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local CommonJS scripts (
scripts/find-strikethroo-root.cjsandscripts/validate-plan-blueprint.cjs) to resolve workspace paths and validate plan metadata. - [INDIRECT_PROMPT_INJECTION]: The operating procedure explicitly directs the agent to read and "execute the instructions" contained in
<root>/config/hooks/PRE_PLAN.mdand<root>/config/hooks/POST_PLAN.md. This creates a surface where an attacker who can modify these files (e.g., via a malicious repository or a pull request) could induce the agent to perform unauthorized actions. - Ingestion points: The skill reads several project-specific files including
STRIKETHROO.md,PRE_PLAN.md,PLAN_TEMPLATE.md, andPOST_PLAN.mdfrom the resolved workspace root. - Boundary markers: The instructions do not specify any boundary markers or sanitization logic when processing the instructions within the hook files.
- Capability inventory: The agent has the capability to read/write files and execute shell commands/scripts as part of the plan refinement process.
- Sanitization: No sanitization or validation of the content within the hook files is performed before execution.
Audit Metadata