plan-page
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The skill reads external data from GitHub PR descriptions (via
gh pr view) and local subject files (<plans>/topics/*.md). - Boundary markers: It uses
<!-- plan-page:start -->and<!-- plan-page:end -->markers to identify and replace content within PR bodies, providing some structural separation. - Capability inventory: The skill can execute shell commands (
node,gh,git), modify local files, and publish content to external platforms like GitHub and Claude.ai (via the Artifact tool). - Sanitization: The instructions refer to a 'refusal' system within the
plan-page.mjsscript that validates the 'shape' and content of plans and subject files before processing. - [COMMAND_EXECUTION]: The skill frequently executes local scripts and command-line utilities to perform its tasks.
- Evidence: Executes
node .agents/pstack/plan-page.mjswith multiple flags (--check,--pr,--comment,--index,--folded) to render and validate pages. - Evidence: Utilizes the
gh(GitHub CLI) tool for automated PR management (gh pr create,gh pr edit,gh pr comment,gh pr view). - Evidence: Uses
gitcommands (e.g.,git show <base>:<path>) to retrieve historical file states during repair operations.
Audit Metadata