planning-with-files
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from planning files and session history which is then injected into the model's prompt.
- Ingestion points: Reads content from
task_plan.md,findings.md,progress.md, and local agent session records (transcripts) stored in Claude Code, Codex, and OpenCode directories. - Boundary markers: Uses
===BEGIN-PWF-DATA===and===END-PWF-DATA===delimiters. v3 modes introduce per-session nonces to prevent delimiter-confusion attacks. - Capability inventory: The skill operates within an environment where
Bash,Write,Edit,Read,Glob, andGreptools are available. - Sanitization: Implements hash attestation (via
attest-plan.sh) to verify that the plan has been approved before injection. Theinject-plan.shscript explicitly labels injected content as untrusted data and uses nonces to raise the bar against adversarial content. - [COMMAND_EXECUTION]: The skill utilizes several local shell and Python scripts (
skill-hook.sh,inject-plan.sh,session-catchup.py, etc.) to manage plan lifecycle events and context injection. These scripts perform necessary filesystem operations, path normalization, and integrity checks as part of the skill's intended functionality.
Audit Metadata