kata-plan-phase
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific files like ROADMAP.md, REQUIREMENTS.md, and STATE.md to generate prompts for subagents such as kata-planner and kata-phase-researcher.
- Ingestion points: Data is ingested from ROADMAP.md, REQUIREMENTS.md, STATE.md, and subagent-generated RESEARCH.md or DISCOVERY.md files.
- Boundary markers: The skill uses XML-style delimiters (e.g., <planning_context>, ) to wrap project content before passing it to subagents, which helps mitigate accidental instruction following.
- Capability inventory: The agent can write files, execute local Node.js and Python scripts, and interact with GitHub repositories via the gh CLI.
- Sanitization: Phase identifiers are normalized via regex in SKILL.md before being used to construct directory paths, providing basic protection against directory traversal via malicious phase names.
- [COMMAND_EXECUTION]: The skill executes local scripts and the GitHub CLI (gh) to manage project metadata and synchronization.
- Evidence: SKILL.md invokes node scripts/kata-lib.cjs for configuration management and python3 ./scripts/update-issue-plans.py for GitHub integration.
- Subprocess Safety: The Python script update-issue-plans.py uses subprocess.run with argument lists rather than shell strings, which is a secure practice that prevents shell injection attacks.
- [EXTERNAL_DOWNLOADS]: The kata-phase-researcher subagent is instructed to use WebSearch and WebFetch tools to gather information about technical stacks and architecture patterns.
- Source Hierarchy: The researcher instructions establish a clear hierarchy, prioritizing official documentation and trusted services (via Context7) over unverified web search results to ensure technical findings are authoritative.
Audit Metadata