Security audit

hplan

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate planning skill, but it persists task details and can silently delete its plan directory without clear user control.

Review before installing, especially for confidential or audit-sensitive work. Use it only if you are comfortable with plan files being created in the workspace and task summaries being saved to long-term memory; consider modifying the instructions to ask before memory writes and to retain or archive completed .plan/ directories unless you explicitly approve deletion.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill expands from local filesystem planning into cross-session memory storage and retrieval, which changes its data handling and persistence characteristics in a security-relevant way. Storing task goals, progress, decisions, and paused-state information in memory without explicit user consent can expose sensitive project details across sessions and to future contexts that query memory.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to silently delete the entire .plan/ directory when it believes all phases are complete, without notifying or confirming with the user. Automatic deletion of workspace files is dangerous because completion state may be wrong, the directory may contain records the user wanted to preserve, and the action is destructive and irreversible in many environments.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill directs deletion of the .plan/ directory without user warning or confirmation, which is a clear unsafe action on user workspace data. In the context of a planning skill, the directory likely contains user-authored requirements, decisions, and progress records, so silent deletion can destroy valuable information and break auditability or recoverability.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs writing project state, decisions, and progress into cross-session memory with no clear privacy disclosure or consent flow. For many tasks, those artifacts may include confidential business goals, implementation details, or sensitive work history, making undisclosed persistence a meaningful privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill description does not clearly warn users that it will create and modify files in the workspace, despite making a .plan/ directory and writing multiple tracking files. Lack of upfront disclosure undermines informed consent and increases the chance of unexpected file-system side effects, especially if the skill activates on broad planning-related language.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.