plan-it-zht
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes platform hooks (UserPromptSubmit, PreToolUse, Stop, PreCompact) to execute shell commands and Python scripts such as 'plan-hook.py' for context management and state validation.
- [PROMPT_INJECTION]: The skill ingests data from 'plan.html' into the agent's context, creating an indirect prompt injection surface. This is mitigated by an evidence chain: 1) Ingestion point: plan.html; 2) Boundary markers: ===BEGIN/END PLAN DATA===; 3) Capability inventory: Bash, Write, Edit, and WebFetch; 4) Sanitization: Instructions to treat data as non-instructional and a SHA-256 attestation mechanism for integrity.
- [COMMAND_EXECUTION]: Manual commands are provided for initializing plans and restoring session context, involving the execution of local scripts like 'session-catchup.py' and 'render-plan.sh'.
Audit Metadata