plan-it

• Outcome: Review
• Latest audit: Aug 30, 2026 · 6:36 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent planning tool, but it needs Review because it auto-runs local hooks, reads local agent session metadata, overstates its integrity protection, and renders trusted raw HTML from plan data.

Review before installing. Use this only if you are comfortable with automatic local hook execution while plan.html exists, local session-metadata checks for catchup, and HTML plan files that should not be opened or shared if their embedded plan data may be untrusted. Treat the SHA-256 badge as tamper-evident only, not proof of authorship or safety.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The skill presents itself as a planning artifact generator, but the documented behavior and hooks extend into cross-tool session inspection, automatic context injection, stop-hook enforcement, integrity mutation, and repository maintenance behaviors. That gap materially increases the risk that users invoke it without understanding its actual access and side effects, which can lead to unintended data exposure or workflow manipulation.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest markets the artifact as tamper-protected, while the body admits the mechanism is only tamper-evident and can be re-sealed by the same agent. That overstatement can cause users to place unjustified trust in the integrity badge and make security decisions based on a control that does not provide real tamper resistance.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The documentation reassures users that probes are never auto-run due to RCE risk, yet the skill auto-executes local Python helper scripts on prompt, tool, stop, and compaction hooks. Even if these are not the same as user-supplied probes, the practical effect is still automatic code execution triggered by normal interaction, which materially expands attack surface.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The integrity model is only tamper-evident and entirely client-side, yet the surrounding claims and UX strongly imply stronger protection. An attacker or even a normal user can modify the embedded plan JSON and re-seal it with a matching hash, so consumers may place unwarranted trust in content that appears 'verified'. In this skill context, the danger is increased because the artifact is explicitly marketed as persistent, shareable, and integrity-protected planning state across environments.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code explicitly treats plan-author-provided component HTML as trusted and inserts it with innerHTML. Because the data is sourced from embedded plan JSON rather than hardcoded DOM-safe construction, any attacker who can influence plan data can inject arbitrary HTML and potentially script-capable payloads, leading to XSS in the rendered artifact.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code path allows arbitrary raw HTML embedded in plan data to be rendered into the page, which is broader than necessary for a planning skill and creates a straightforward DOM XSS sink. The surrounding skill context makes this more dangerous because plan content may be AI-generated, user-supplied, or persisted across sessions, increasing the chance that untrusted markup reaches the browser unchanged.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

UserPromptSubmit:
    - hooks:
        - type: command
          command: "if [ -f plan.html ]; then PY=$(command -v python3 || command -v python); HELPER=\"${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/skills/plan-it}/scripts/plan-hook.py\"; if [ -z \"$PY\" ] || [ ! -f \"$HELPER\" ]; then HELPER=$(ls \"$HOME/.claude/skills/plan-it/scripts/plan-hook.py\" \"$HOME/.claude/plugins/marketplaces/plan-it/scripts/plan-hook.py\" 2>/dev/null | head -1); fi; if [ -n \"$PY\" ] && [ -n \"$HELPER\" ] && [ -f \"$HELPER\" ]; then \"$PY\" \"$HELPER\" inject --mode summary --lines 30; else echo '[plan-it] plan.html present but helper script not found. Run /plan to re-init.'; fi; fi"
  PreToolUse:
    - matcher: "Write|Edit|Bash|Read|Glob|Grep"
      hooks:

• Confidence: 91% confidence
• Finding: The hook enumerates local skill/plugin installation paths in the user's home directory to locate executable helper code. Directory enumeration of local tooling can leak environment structure and enables execution from multiple fallback locations, increasing the chance of running an unexpected or substituted script if those paths are writable or compromised.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- matcher: "Write|Edit|Bash|Read|Glob|Grep"
      hooks:
        - type: command
          command: "if [ -f plan.html ]; then PY=$(command -v python3 || command -v python); HELPER=\"${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/skills/plan-it}/scripts/plan-hook.py\"; if [ -z \"$PY\" ] || [ ! -f \"$HELPER\" ]; then HELPER=$(ls \"$HOME/.claude/skills/plan-it/scripts/plan-hook.py\" \"$HOME/.claude/plugins/marketplaces/plan-it/scripts/plan-hook.py\" 2>/dev/null | head -1); fi; if [ -n \"$PY\" ] && [ -n \"$HELPER\" ] && [ -f \"$HELPER\" ]; then \"$PY\" \"$HELPER\" inject --mode active-phase --lines 15; fi; fi"
  PostToolUse:
    - matcher: "Write|Edit"
      hooks:

• Confidence: 91% confidence
• Finding: This pre-tool hook repeats directory enumeration and dynamic helper resolution before routine tool usage, which magnifies exposure because it occurs frequently and automatically. In a hostile local environment, a malicious script placed in one of the searched locations could be selected and executed during normal workflow.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Stop:
    - hooks:
        - type: command
          command: "if [ -f plan.html ]; then PY=$(command -v python3 || command -v python); HELPER=\"${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/skills/plan-it}/scripts/plan-hook.py\"; if [ -z \"$PY\" ] || [ ! -f \"$HELPER\" ]; then HELPER=$(ls \"$HOME/.claude/skills/plan-it/scripts/plan-hook.py\" \"$HOME/.claude/plugins/marketplaces/plan-it/scripts/plan-hook.py\" 2>/dev/null | head -1); fi; if [ -n \"$PY\" ] && [ -n \"$HELPER\" ] && [ -f \"$HELPER\" ]; then \"$PY\" \"$HELPER\" check-complete; fi; fi"
  PreCompact:
    - matcher: "*"
      hooks:

• Confidence: 90% confidence
• Finding: The stop hook again resolves helper code by enumerating local directories and then executes it automatically. Because stop-time checks influence completion and state, compromise here can both expose environment details and tamper with task-completion logic in a way the user may not notice.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

- matcher: "*"
      hooks:
        - type: command
          command: "if [ -f plan.html ]; then echo '[plan-it] PreCompact: context compaction about to occur.'; echo 'Before compaction completes: ensure plan.html embedded JSON captures recent progress_log entries and current_phase status.'; echo 'plan.html remains on disk and will be re-read after compaction.'; PY=$(command -v python3 || command -v python); HELPER=\"${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/skills/plan-it}/scripts/plan-hook.py\"; if [ -z \"$PY\" ] || [ ! -f \"$HELPER\" ]; then HELPER=$(ls \"$HOME/.claude/skills/plan-it/scripts/plan-hook.py\" \"$HOME/.claude/plugins/marketplaces/plan-it/scripts/plan-hook.py\" 2>/dev/null | head -1); fi; if [ -n \"$PY\" ] && [ -n \"$HELPER\" ] && [ -f \"$HELPER\" ]; then \"$PY\" \"$HELPER\" attestation; fi; fi; exit 0"
metadata:
  version: "0.2.0"
---

• Confidence: 90% confidence
• Finding: The pre-compaction hook performs the same directory enumeration and dynamic execution pattern at a sensitive lifecycle point where context preservation decisions are being made. Automatic execution during compaction raises integrity concerns because a substituted helper could alter attestation or preservation behavior without explicit user action.

Static analysis

No suspicious patterns detected.