k2f-travel-planner
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of a core dependency, suzheng/k2f, which is a resource provided by the same author to handle layout and formatting.
- [COMMAND_EXECUTION]: The instructions involve executing a shell command (npx skills add) to install the necessary component for travel planner generation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied information including destinations, dates, and confirmed bookings to build the planner.
- Ingestion points: User trip constraints, interests, and confirmed bookings are ingested into the content_and_design.md blueprint (Step 1, Sub-steps 1 and 2).
- Boundary markers: The skill uses NEEDS USER INPUT and 'verify before travel' stubs to differentiate between user-confirmed data and generated suggestions.
- Capability inventory: The workflow involves creating a markdown blueprint and subsequently using the k2f skill to package and export the document to PDF or print-ready formats.
- Sanitization: Validation is performed via 'Truth', 'Pace', and 'Budget' gates which reconcile generated content against the user's original inputs and constraints.
Audit Metadata