planning-contract
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides an installation command utilizing
npxto fetch thelegout/skillspackage from the author's repository. - [COMMAND_EXECUTION]: The skill documents a shell command (
npx skills add) meant for users or automated installers to deploy the planning contract within an agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for the agent to ingest and classify external documentation from project directories, which constitutes an indirect prompt injection vector.
- Ingestion points:
project/research/,project/adr/,project/specs/,project/plans/, andproject/tickets/directories. - Boundary markers: The contract enforces strict directory-based classification rules and requires explicit owner approval for document state changes.
- Capability inventory: Not applicable; this skill file defines organizational rules and does not include executable scripts.
- Sanitization: No explicit content sanitization or input filtering is mentioned for the processed artifacts.
Audit Metadata