plan-it-es
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines multiple lifecycle hooks (
UserPromptSubmit,PreToolUse,PostToolUse,Stop,PreCompact) that execute shell commands. These commands are used to locate and run local Python scripts, such asplan-hook.pyandsession-catchup.py, which manage the planning state and inject relevant context into the agent's prompt. - [PROMPT_INJECTION]: The skill automates the ingestion of data from a local file (
plan.html) into the prompt context via shell hooks. This creates a surface for indirect prompt injection if the file is modified by an untrusted process. - Ingestion points: The contents of
plan.htmlare read and injected into the prompt by theplan-hook.pyscript triggered throughSKILL.mdhooks. - Boundary markers: The skill uses
===BEGIN PLAN DATA===and===END PLAN DATA===markers to delineate injected content and prevent it from being interpreted as direct instructions. - Capability inventory: The skill allows access to
Read,Write,Edit,Bash,Glob,Grep, andWebFetchtools. - Sanitization: No explicit sanitization or filtering of the file content is mentioned in the documentation beyond the use of boundary delimiters.
Audit Metadata