Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed file-based planning helper whose hooks, local files, optional session replay, and gated-stop behavior are purpose-aligned and locally scoped.
Install only if you want project planning files and lifecycle hooks that place selected planning context into the agent’s prompt. Avoid putting secrets in task_plan.md or progress.md, use --replay for session catchup only when you are comfortable surfacing prior same-project transcript excerpts, and enable gated mode only for tasks where stop-blocking behavior is desired.
Referenced artifact was not completely inspected
1. Use the installed `scripts/resolve-plan-dir.sh` (or `.ps1`) with the task's `PLAN_ID` and `PWF_PLAN_ROOT`. Read `task_plan.md`, `progress.md`, and `findings.
Referenced artifact was not completely inspected
1. Use the installed `scripts/resolve-plan-dir.sh` (or `.ps1`) with the task's `PLAN_ID` and `PWF_PLAN_ROOT`. Read `task_plan.md`, `progress.md`, and `findings.
Referenced artifact was not completely inspected
1. Use the installed `scripts/resolve-plan-dir.sh` (or `.ps1`) with the task's `PLAN_ID` and `PWF_PLAN_ROOT`. Read `task_plan.md`, `progress.md`, and `findings.
Referenced artifact was not completely inspected
- **Templates and scripts** are relative to this installed `SKILL.md`. Plugin installs also expose them under `${CLAUDE_PLUGIN_ROOT}/`.
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
k directory.** Reuse the selected plan when resuming. For a separate task, run `scripts/init-session.sh "Task Name"` and use the printed `PLAN_ID` to pin its ho
Referenced artifact was not completely inspected
- `scripts/set-active-plan.sh` — Switch or inspect the active plan pointer (`.planning/.active_plan`). Run with `--list` to show named plans and phase counts, w
Referenced artifact was not completely inspected
- `scripts/set-active-plan.sh` — Switch or inspect the active plan pointer (`.planning/.active_plan`). Run with `--list` to show named plans and phase counts, w
Referenced artifact was not completely inspected
- `scripts/check-complete.sh` — Verify all phases in the active plan are complete.
Referenced artifact was not completely inspected
- `scripts/check-complete.sh` — Verify all phases in the active plan are complete.
Referenced artifact was not completely inspected
- `scripts/check-complete.sh` — Verify all phases in the active plan are complete.
Referenced artifact was not completely inspected
The standalone `scripts/skill-hook.sh` reads the host's JSON session identity. UserPromptSubmit emits plain context; PreToolUse and PostToolUse emit the event's
Referenced artifact was not completely inspected
mantic signal) rather than `progress.md` mtime (which moves on any touch). See `scripts/ledger-append.sh` and `scripts/ledger-summary.sh`.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
flock -w 5 9 || true
mv -f "${tmp_file}" "${attestation_file}"
) 9>"${lock_dir}/.attestation.lock" 2>/dev/null || mv_ok=0
rm -f "${lock_dir}/.attestation.lock" 2>/dev/null
else
mv -f "${tmp_file}" "${attestation_file}" 2>/dev/null || mv_ok=0
fi
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# (a) reset the gate block counter and drop any stale gate ledger so a prior
# run's high block count cannot let the next run stop instantly.
printf '0\n' > "${_mode_dir}/.stop_blocks"
rm -f "${_mode_dir}/.gate_last_ledger" 2>/dev/null || true
# (b) write a fresh 16-hex nonce for delimiter framing.
gen_nonce > "${_mode_dir}/.nonce"
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The script intentionally extracts and re-emits prior session content from local transcript stores, including user/assistant messages and tool summaries after the last planning-file update. Although it adds framing, truncation, same-project checks, and gated modes, replay mode can still surface sensitive prior-session content into a fresh agent context, creating confidentiality risk and indirect prompt-injection exposure from recovered text.
def extract_messages_after(messages: List[Dict[str, Any]], after_line: int) -> List[Dict[str, Any]]:
"""Extract conversation messages after a certain line number."""
tool_results = collect_claude_tool_results(messages)
result = []
for msg in messages:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
UserPromptSubmit:
- hooks:
- type: command
command: "[ -n \"${CLAUDE_PLUGIN_ROOT:-}\" ] && exit 0; SH=\"${CLAUDE_SKILL_DIR}/scripts/skill-hook.sh\"; [ -f \"$SH\" ] || SH=$(ls \"$HOME/.claude/skills/planning-with-files/scripts/skill-hook.sh\" \"$HOME/.claude/plugins/marketplaces/planning-with-files/scripts/skill-hook.sh\" 2>/dev/null | head -1); [ -n \"$SH\" ] && [ -f \"$SH\" ] && sh \"$SH\" --event=userprompt; exit 0"
PreToolUse:
- matcher: "Write|Edit|Bash|Read|Glob|Grep"
hooks:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
UserPromptSubmit:
- hooks:
- type: command
command: "[ -n \"${CLAUDE_PLUGIN_ROOT:-}\" ] && exit 0; SH=\"${CLAUDE_SKILL_DIR}/scripts/skill-hook.sh\"; [ -f \"$SH\" ] || SH=$(ls \"$HOME/.claude/skills/planning-with-files/scripts/skill-hook.sh\" \"$HOME/.claude/plugins/marketplaces/planning-with-files/scripts/skill-hook.sh\" 2>/dev/null | head -1); [ -n \"$SH\" ] && [ -f \"$SH\" ] && sh \"$SH\" --event=userprompt; exit 0"
PreToolUse:
- matcher: "Write|Edit|Bash|Read|Glob|Grep"
hooks:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
UserPromptSubmit:
- hooks:
- type: command
command: "[ -n \"${CLAUDE_PLUGIN_ROOT:-}\" ] && exit 0; SH=\"${CLAUDE_SKILL_DIR}/scripts/skill-hook.sh\"; [ -f \"$SH\" ] || SH=$(ls \"$HOME/.claude/skills/planning-with-files/scripts/skill-hook.sh\" \"$HOME/.claude/plugins/marketplaces/planning-with-files/scripts/skill-hook.sh\" 2>/dev/null | head -1); [ -n \"$SH\" ] && [ -f \"$SH\" ] && sh \"$SH\" --event=userprompt; exit 0"
PreToolUse:
- matcher: "Write|Edit|Bash|Read|Glob|Grep"
hooks:
No suspicious patterns detected.