planning-with-files
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a suite of shell and Python scripts (e.g.,
skill-hook.sh,inject-plan.sh,check-complete.sh) to automate task tracking and status verification. These operations are restricted to the project's local environment and are essential to the skill's primary function. - [INDIRECT_PROMPT_INJECTION]: The skill processes planning files (
task_plan.md,findings.md) which may contain untrusted data from external sources. To defend against injection, the skill implements 'nonce-framed' data delimiters (===BEGIN-PWF-DATA ... nonce=... ===) and provides explicit instructions to the AI agent to treat the injected content as non-authoritative structured data. - [DYNAMIC_EXECUTION]: Shell scripts within the skill (such as
inject-plan.sh) execute embedded Python code snippets to perform safe filesystem operations, such as canonicalizing paths and managing file descriptors, which are used to enforce security boundaries. - [DATA_EXFILTRATION]: The
session-catchup.pyscript reads sensitive local data including previous conversation transcripts from~/.claude/projects/and~/.codex/sessions/. However, this is used for legitimate session recovery purposes and includes strict filtering (filter_sessions_by_cwd) to ensure the agent only accesses data belonging to the current project. No network transmission of this data was identified.
Audit Metadata