pi-planning-with-files
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill inherently processes untrusted project data but implements robust mitigations.
- Ingestion points: Planning files (
task_plan.md,findings.md,progress.md) and local IDE session transcripts are read and injected into the agent context. - Boundary markers: Present. Injected content is wrapped in
===BEGIN-PWF-DATA ... ===and===END-PWF-DATA ... ===delimiters. - Capability inventory: The skill uses
subprocess.run(Python) andspawnSync(Node.js) to execute bundled helper scripts for state resolution and integrity checking. It uses standard file operations for reading and writing planning files. - Sanitization: The skill provides a hash attestation mechanism (
attest-plan.sh) and explicitly instructs the agent to treat injected content as data only, ignoring any instruction-like text within those files. - [COMMAND_EXECUTION]: The skill executes local shell, Python, and PowerShell scripts. These are bundled with the skill and used for internal logic (e.g., counting phases, verifying attestations). The commands are executed with controlled arguments and restricted to the project environment.
- [DATA_EXPOSURE]: The skill accesses local IDE transcript stores (e.g., Claude Code, OpenCode) to assist with session recovery. This is a primary feature of the skill, and the process is local with no network exfiltration path detected.
- [PRIVILEGE_ESCALATION]: The skill extension includes a security feature that monitors for and warns the user about dangerous shell commands (e.g.,
sudo,chmod 777,rm -rf) before they are executed by the agent.
Audit Metadata