create-plans
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from the project's source code, package.json, and planning artifacts to generate phase-specific implementation plans.
- Ingestion points: Project source code (src/), package.json, and existing planning metadata (.planning/BRIEF.md, ROADMAP.md).
- Boundary markers: The skill uses XML-style tags (e.g., , ) in templates to provide structure and delimitation for generated content.
- Capability inventory: The agent has shell execution (Bash), file system access (Write, Read), and Git operations.
- Sanitization: No explicit content sanitization or instruction-filtering blocks are used before processing project data.
- [COMMAND_EXECUTION]: Project Reconnaissance and Version Control. The skill uses shell commands for project state analysis and version control lifecycle management. Status checks in SKILL.md and workflow files execute commands like git rev-parse, ls, and find to understand the environment.
- [SAFE]: Benign Dynamic Context Injection. The research-prompt.md template uses the !command syntax (!
date) to inject the current system date into the research context, which is a standard and safe operation. - [SAFE]: Secure Secret Handling. The skill encourages best practices by managing credentials via environment variables (.env files) and using dynamic checkpoints to request authentication only when required, rather than hardcoding sensitive data. Example keys in documentation are non-functional placeholders.
Audit Metadata