plankton-code-quality
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill configuration directs the agent to execute shell scripts (
multi_linter.sh,protect_linter_configs.sh) downloaded from an external source (https://github.com/alexfazio/plankton.git). These scripts are integrated asPreToolUseandPostToolUsehooks, allowing them to run automatically without explicit user intervention during file operations. - [COMMAND_EXECUTION]: The skill uses the
claude -pcommand to spawn new agent instances in subprocesses. This automated delegation of tasks to secondary models (Haiku, Sonnet, Opus) involves executing shell commands to process results from linting tools. - [EXTERNAL_DOWNLOADS]: The setup process requires cloning a non-whitelisted repository from GitHub (
alexfazio/plankton) and installing multiple third-party tools and libraries (jaq,ruff,uv,biome, etc.) from external package registries. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads project files, generates a structured JSON report of violations, and passes this data into an AI subprocess (
claude -p). A malicious actor could embed instructions within code comments or logic that are then interpreted by the subprocess as valid commands or context. - Ingestion points: Project source code files, configuration files, and linter output JSON.
- Boundary markers: None documented for the data passed between the hook and the
claude -psubprocess. - Capability inventory: The system can write to files, execute shell scripts via hooks, and spawn new agent instances with tool access.
- Sanitization: No evidence of sanitization or escaping of the code violations before they are passed to the delegated model.
Audit Metadata