editor-harvest-plan

Pass

Audited by Gen Agent Trust Hub on Jul 2, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill contains strong defensive instructions in its 'Hard Policy' section, explicitly stating that user-supplied phrases cannot override the planning boundaries. This protects against attempts to force the agent into executing code prematurely.
  • [COMMAND_EXECUTION]: The skill invokes local utility scripts (e.g., create-goal-scratchpad.mjs, check-complete.mjs) and standard development tools like rg (ripgrep) and pnpm. These operations are used for internal state management and verification within the project's own directory structure.
  • [SAFE]: The skill implements a 'Read First' policy and license/provenance discipline that requires the agent to summarize behavior rather than copying external code or prose, which effectively mitigates risks from potentially malicious data in processed reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 2, 2026, 05:10 PM
Security Audit — agent-trust-hub — editor-harvest-plan