ia-planning
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is internally coherent for a planning workflow: it scaffolds a .plan/ directory, writes ephemeral planning files, and includes a small scaffold script; no credentials, installs, or external endpoints are requested — but a prompt-injection detector flagged unicode-control characters in SKILL.md and there are a few small documentation/expectation mismatches to review before installing.
This skill appears to be what it claims: a local planning workflow that scaffolds a .plan/ folder and writes ephemeral planning files. Before installing: 1) Inspect SKILL.md for hidden/unexpected characters (the scanner found unicode control chars); remove or ask the author to explain them. 2) Review scripts/init-plan.sh (included) to confirm it only scaffolds files and edits .gitignore (it does). 3) Be aware the workflow reads repository files (grep/git) — run it in a sandboxed repo or ensure .plan/ is not committed (the script adds .plan/ to .gitignore). 4) Note the minor doc mismatch: the instructions assume shell/git are available even though no binaries are declared — ensure your environment provides these tools. If those checks are acceptable, the skill is coherent and can be used.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.