plannotator-guide

Fail

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Plannotator CLI using the pattern curl -fsSL https://plannotator.ai/install.sh | bash. This pattern involves downloading a script from the vendor's domain and executing it directly within the host's shell.
  • [COMMAND_EXECUTION]: The skill relies on the execution of multiple system and CLI commands, including git diff, gh pr checkout, gh pr view, and the plannotator CLI, to process repository data and manage guides.
  • [DATA_EXFILTRATION]: The plannotator guide share command initiates an upload of the generated guide and code diff (patch) to a remote service (guides.show). Although the skill describes the transfer as encrypted, it facilitates the movement of repository content to external servers.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download an installation script from https://plannotator.ai/install.sh if the required CLI tool is missing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs (saved to guide.patch) to generate orientation and explanatory text.
  • Ingestion points: Content is read from guide.patch, which contains arbitrary diff data from the repository.
  • Boundary markers: None identified in the prompt instructions to isolate the diff content from the agent's instructions.
  • Capability inventory: The skill has access to shell execution (git, gh, plannotator) and remote script installation capabilities.
  • Sanitization: No specific sanitization or validation of the diff content is mentioned before it is processed by the agent.
Recommendations
  • HIGH: Downloads and executes remote code from: https://plannotator.ai/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 19, 2026, 05:54 PM
Security Audit — agent-trust-hub — plannotator-guide