refined-plan-mode
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by reading and processing feedback from external files located in '.plan-review/feedback/*.json'. This feedback is used to automatically revise plans. * Ingestion points: .plan-review/feedback/plan-vN-feedback.json (SKILL.md) * Boundary markers: None identified; content is interpolated into the planning context. * Capability inventory: The agent can inspect repository files, perform focused edits, and execute shell commands once a plan is approved. * Sanitization: No explicit sanitization or validation of the JSON feedback content is mentioned. * Mitigation: The risk is significantly reduced by the 'Execution Gate' protocol which mandates that no implementation begins until a user has explicitly approved the plan.
- [SAFE]: The 'Reset' functionality incorporates a security best practice by requiring the user to explicitly type 'RESET' or provide a '--force' flag before clearing the local state, preventing accidental data loss.
- [SAFE]: The skill enforces an 'Execution Gate' which prevents the agent from autonomously proceeding with implementation until a Markdown artifact has been reviewed and approved by a human user.
Audit Metadata