plan-it-de
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses extensive shell hooks (
UserPromptSubmit,PreToolUse,PostToolUse,Stop,PreCompact) to automate state management. These hooks execute shell commands that attempt to locate and run Python helper scripts from several possible local directories (e.g.,$HOME/.claude/skills/plan-it/scripts/plan-hook.py). - [PROMPT_INJECTION]: Indirect Prompt Injection Surface (Category 8):
- Ingestion points: The skill automatically reads the contents of
plan.html(specifically the embedded JSON data) and injects a summary into the agent's context during tool use and prompt submission. - Boundary markers: The skill uses explicit delimiters (
===BEGIN PLAN DATA===and===END PLAN DATA===) to wrap injected content, which helps the agent distinguish between data and instructions. - Capability inventory: The skill has access to
Read,Write,Edit,Bash,Glob,Grep, andWebFetchtools (as defined inallowed-tools). - Sanitization: The instructions explicitly direct the agent to treat content within the markers as structured data rather than executable instructions, and it provides an optional SHA-256 attestation mechanism (
/plan-attest) to detect unauthorized modifications to the plan file.
Audit Metadata