skills/mblode/agent-skills/planning/Gen Agent Trust Hub

planning

Pass

Audited by Gen Agent Trust Hub on Aug 5, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes several standard command-line tools for codebase discovery and claim verification. These include git (for log and history analysis), grep, find, wc, and various test runners such as npm test, pytest, and cargo test. It also suggests using curl for checking local API responses and latency.
  • [DATA_EXPOSURE]: As part of its core functionality, the skill scans local repository documentation, including ADRs, RFCs, and READMEs, as well as source code to establish context for implementation plans.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided implementation plans and external project documentation, which constitutes an ingestion surface for untrusted data.
  • Ingestion points: Processes intent from user requests, reads local plan files, and scans project documentation (e.g., docs/adr/, rfcs/) as defined in references/doc-grounding.md.
  • Boundary markers: The skill employs a structured 'Review mode' with a scoring rubric and decision principles (KISS, YAGNI, Ladder of Least Code) to evaluate the quality and scope of incoming plans.
  • Capability inventory: The skill can write plan files, generate local HTML question forms, and execute local discovery or testing commands.
  • Sanitization: The 'Interrogation protocol' and 'Rubber duck loop' require the agent to actively challenge assumptions and verify claims with evidence, providing a functional validation layer against adversarial or incorrect input.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 5, 2026, 03:57 PM
Security Audit — agent-trust-hub — planning