plan-loader
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from the project's .claude/plans/ directory and incorporates it into the agent's context.
- Ingestion points: The skill reads .claude/plans/active.json, .claude/plans/mission.md, and tiered plan markdown files from the local filesystem.
- Boundary markers: There are no explicit delimiters present to isolate the loaded plan content from the agent's instructions, though the skill applies a 'trust: plan' label to the data.
- Capability inventory: The skill leverages Read, Glob, and Bash tools. It does not possess network access or file-writing capabilities, limiting the potential scope of any injection attack.
- Sanitization: No sanitization or filtering is performed on the content of the loaded files before they are presented to the agent.
Audit Metadata