masterplan-executor

• Outcome: Pass
• Latest audit: Jul 31, 2026 · 1:58 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed high-agency project execution workflow, with no hidden or malicious behavior found.

Install this only if you want an agent to actively modify a project from an existing masterplan, run verification commands, consult the web automatically for implementation questions, create a repo-local execution log, and make local commits. For confidential or restricted repositories, consider disabling web access or asking the agent to confirm before searches and commits.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example trigger phrases are broad enough to overlap with ordinary user requests like 'build this' or 'continue where we left off,' which can cause the skill to activate in situations where the user did not explicitly consent to this specific workflow. In this skill's context, that is more dangerous because activation leads to code execution behavior, persistent logging, and automatic web research, expanding the consequences of accidental invocation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description emphasizes automatic web research as part of execution but does not present it as a prominent user warning at the point of invocation. This can lead users to unknowingly trigger outbound network activity and have implementation decisions influenced by external content, which is especially sensitive in a code-executing skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to perform web_search/web_fetch automatically and 'without asking the user's permission first.' In a codebase-execution skill, this can cause unintended network egress, disclosure of sensitive implementation details through queries, and violation of user or organizational expectations in restricted environments.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to create and continuously update docs/masterplan/execution-log.md without an explicit user warning or confirmation. In a repository-modifying skill, silent file creation and persistent state changes can overwrite expectations, pollute commits, or leave sensitive implementation notes in the repo without the user's awareness.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template explicitly instructs the agent to create and continuously update `docs/masterplan/execution-log.md`, which is a persistent file modification in the user's workspace. Because the instruction does not require prior user confirmation or even a warning before creating or overwriting this file, it can cause silent state changes, unexpected repository diffs, and persistence of potentially sensitive execution details across sessions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Follow `references/phase-execution-checklist.md` for the mechanical steps. For each phase, in strict roadmap order:

1. **Re-read the plan sections that scope this phase** — the relevant features with their acceptance criteria, tech-stack entries, data-model pieces, API contract, adaptive-system requirements, and the specific production-readiness items that apply to this phase's surface area.
2. **Resolve ambiguity via research, automatically, never via guessing.** If anything needed to implement this phase correctly is unclear, underspecified, contradicts something else in the plan, or the plan's stated approach seems outdated or wrong now that you're actually implementing it — `web_search` (and `web_fetch` official docs/changelogs/release notes) to find the current, valid, correct way to do it before writing the code. This covers: exact current API/syntax of a chosen library or framework, current security best practice for a specific mechanism, resolving an internal contradiction in the plan, or confirming a version/approach is still the right one. Do this without asking the user's permission first — it's the default behavior, not an escalation. Only surface it to the user afterward if the research changes something user-facing or a major architecture decision (see Phase 3).
3. **Implement to the standard in `references/execution-standards.md`** — real error handling, real config/secrets management, real input validation, real structured logging, environment-adaptive behavior wherever the plan calls for it, no dead code, no silent failures. Not a version "to be hardened later" — the version that ships. If this step is done surgically via subagents/parallel workers, gate concurrency per `references/resource-safety.md` — recompute the safe concurrency budget from freshly detected available RAM before spawning each batch, never from a fixed number or a prior session's reading. When in doubt or detection is unavailable, execute sequentially instead of risking an OOM.

...[truncated 25 chars]

• Confidence: 91% confidence
• Finding: The skill authorizes autonomous decisions about when to conduct research and how to proceed, specifically stating to do so without asking permission first. In this context, the autonomy is risky because it combines external access, code changes, and architectural decision-making, reducing human oversight over actions that may affect confidentiality, compliance, or system integrity.

Static analysis

No suspicious patterns detected.