planning-with-files
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest context from local planning files (
task_plan.md,findings.md,progress.md) and historical session transcripts (viascripts/session-catchup.py). This creates an inherent surface for indirect prompt injection if external content or previous logs contain adversarial instructions. - Ingestion Points: Planning files in the project root or
.planning/directory, and Claude/Codex/OpenCode session stores located in user home directories. - Boundary Markers: The skill implements strong boundary markers using nonce-delimited blocks (e.g.,
===BEGIN-PWF-DATA kind=plan nonce=[hash] ... ===) to prevent delimiter-confusion attacks. - Capability Inventory: The skill operates within an environment where
Bash,Read,Write,Edit,Glob, andGreptools are available. - Sanitization: Content is systematically framed as untrusted data, and the skill implements SHA-256 attestation (via
scripts/attest-plan.sh) to detect and block the injection of plans that have been modified without user approval.
Audit Metadata