Security audit
Security checks for vulnerabilities and agentic risk
This planner skill stores user-created planning data locally in disclosed JSON files and does not show hidden networking, unsafe execution, or deceptive behavior.
Install this only if you are comfortable with plans being saved locally across sessions. Avoid storing secrets or highly sensitive personal details in plans, and periodically review or delete the planner JSON files if retention matters to you.
The skill advertises local file persistence and references multiple scripts that read and write plan data, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity where the runtime may grant broader file access than users or reviewers expect, increasing the risk of unintended reads or writes to local data.
The skill explicitly maintains persistent local storage for plans and archives, which means potentially sensitive user goals, schedules, budgets, and project details can remain on disk across sessions. Even without network exfiltration, session persistence increases privacy and confidentiality risk if data is retained longer than expected or accessed by other local processes or users.
---
name: planner
description: Local-first planning engine for trips, weeks, launches, projects, schedules, and structured decision-making. Use whenever the user wants to plan something, organize future steps, create a roadmap, map constraints, compare options, or turn a vague goal into a phased plan. Also use when the user says they need a plan, itinerary, schedule, rollout, timeline, or structured next steps. Local-only storage.
---
# Planner: Turn uncertainty into a workable plan.
The activation text is extremely broad, triggering on generic requests like needing a plan, roadmap, schedule, or structured next steps. Over-broad routing can cause the skill to be invoked in contexts the user did not intend, leading to unnecessary data capture or file persistence of sensitive personal, project, or scheduling information.
No suspicious patterns detected.