plannotator-guide
Fail
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Plannotator CLI using the pattern
curl -fsSL https://plannotator.ai/install.sh | bash. This pattern involves downloading a script from the vendor's domain and executing it directly within the host's shell. - [COMMAND_EXECUTION]: The skill relies on the execution of multiple system and CLI commands, including
git diff,gh pr checkout,gh pr view, and theplannotatorCLI, to process repository data and manage guides. - [DATA_EXFILTRATION]: The
plannotator guide sharecommand initiates an upload of the generated guide and code diff (patch) to a remote service (guides.show). Although the skill describes the transfer as encrypted, it facilitates the movement of repository content to external servers. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download an installation script from
https://plannotator.ai/install.shif the required CLI tool is missing. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs (saved to
guide.patch) to generate orientation and explanatory text. - Ingestion points: Content is read from
guide.patch, which contains arbitrary diff data from the repository. - Boundary markers: None identified in the prompt instructions to isolate the diff content from the agent's instructions.
- Capability inventory: The skill has access to shell execution (
git,gh,plannotator) and remote script installation capabilities. - Sanitization: No specific sanitization or validation of the diff content is mentioned before it is processed by the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://plannotator.ai/install.sh - DO NOT USE without thorough review
Audit Metadata