Security audit

Plan C

Security checks for vulnerabilities and agentic risk

Overview

This skill is a planning assistant that reads existing planning files and, when asked for deeper iteration, may inspect project code and update the planning document.

Install only if you want an assistant that can read existing planning documents, inspect relevant project files during deeper analysis, and update the original planning file. Use explicit file paths and make clear when you want read-only summary versus document updates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The summary-mode trigger rules are overly broad and include common conversational terms such as '总结', '状态', '概况', and '继续对话'. This can cause the skill to misclassify a user request and automatically read and summarize a referenced planning file when the user did not clearly intend a file load, increasing the chance of unintended disclosure of planning content or stale-context actions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The deep-exploration triggers rely on generic keywords like '分析', '扫描', and '细化' without sufficient scope constraints. In practice, this can route benign discussion into repository exploration and planning-file modification flows, causing unnecessary codebase access and follow-on writes based on ambiguous user phrasing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs saving updates back to the original planning file, but the description does not prominently warn users that invocation may modify existing files. This creates a consent and integrity risk: a user may believe they are only loading or reviewing a plan, while the skill can transition into a mode that persists changes to project documentation.

Static analysis

No suspicious patterns detected.