supervise-plan
Warn
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Employs AppleScript (
osascript) to automate the Ghostty terminal emulator. This allows the skill to programmatically open new terminal tabs and inject shell commands, such asclaude "/execute-plan ...", into the user's active shell environment. - [DATA_EXFILTRATION]: Accesses sensitive session transcripts stored in
~/.claude/projects/. The skill reads JSONL files containing the full history of interactions between the user and the agent to calculate context window usage. - [COMMAND_EXECUTION]: Executes dynamic Python code via the shell (
python3 -c) to parse internal application data and environment variables such asCLAUDE_CODE_SESSION_ID. - [REMOTE_CODE_EXECUTION]: Utilizes an autonomous loop mechanism to persistently reschedule its own execution every 10 minutes, effectively creating a background daemon without direct user oversight for each wake cycle.
- [PROMPT_INJECTION]: Ingests status lines and headings from local files (
plan.md,mailbox.md) to drive its control logic. This creates an attack surface for indirect prompt injection if those files are modified by untrusted third-party processes or external data.
Audit Metadata