Planning with files

• Outcome: Review
• Latest audit: Aug 19, 2026 · 8:59 PM UTC
• Version: 3.10.2

Overview

This planning skill is coherent, but it should be reviewed because its recovery workflow can read and replay prior local agent transcripts without per-run confirmation.

Install only if you are comfortable with a planning helper that stores project planning files and may surface prior local agent-session snippets during recovery. Avoid using it in workspaces containing secrets or sensitive chats unless you are prepared to review/disable the catchup workflow and keep planning files under your control; use attestation for long-running or gated plans.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The declared description frames the skill as a simple file-based planning helper, but the documented behavior is substantially broader: prompt injection hooks, transcript/session recovery, attestation enforcement, stop-gating, and ledger management. This mismatch is dangerous because users may enable a low-risk sounding skill without realizing it can read historical session artifacts and influence model control flow on every turn.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints prior-session user/assistant messages and tool activity directly to stdout during startup, which can expose sensitive prompts, code, secrets, file paths, and command history from earlier sessions without explicit user consent at the time of disclosure. In a persistent planning skill, this is especially risky because the behavior is automatic on SessionStart and may surface context from prior work into a fresh session, logs, terminal scrollback, screen sharing, or other observers.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The notes include explicit attention-shaping language such as 'Re-read this plan before major decisions (attention manipulation)', which is designed to steer agent behavior beyond simple documentation. In a persistent planning skill, this can bias future reasoning across turns and sessions, making it easier for embedded instructions in files to influence agent decision-making in ways the user did not request.

Context Leakage

High

• Category: Data Exfiltration

Content

def extract_messages_after(messages: List[Dict[str, Any]], after_line: int) -> List[Dict[str, Any]]:
    """Extract conversation messages after a certain line number."""
    tool_results = collect_claude_tool_results(messages)
    result = []
    for msg in messages:

• Confidence: 96% confidence
• Finding: Extract conversation

Hidden Instructions

High

• Category: Prompt Injection

Content

# Task Plan: [Brief Description]
<!-- 
  WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk."
  WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.
  WHEN: Create this FIRST, before starting any work. Update after each phase completes.

• Confidence: 86% confidence
• Finding: <!-- WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk." WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Task Plan: [Brief Description]
<!--
  WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk."
  WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.
  WHEN: Create this FIRST, before starting any work. Update after each phase completes.

• Confidence: 96% confidence
• Finding: <!-- WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk." WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh. W

Hidden Instructions

High

• Category: Prompt Injection

Content

-->

## Run Contract
<!--
  WHAT: The rules this run operates under. The orchestrating agent reads this once at the
        top of the run and the gate honors it. None of these change v2 behavior unless a
        mode is explicitly set; default-everything here equals legacy semantics.

• Confidence: 98% confidence
• Finding: <!-- WHAT: The rules this run operates under. The orchestrating agent reads this once at the top of the run and the gate honors it. None of these change v2 behavior unless a mode is

Hidden Instructions

High

• Category: Prompt Injection

Content

these fields mirror. If you hand-edit, keep this block in sync with .planning/<id>/.mode.
-->
- **Mode:** gated
  <!-- autonomous = low recitation, no completion gate. gated = completion gate active (Stop
       hook may hold the turn until the in_progress phase clears). Omit the mode (or no .mode
       file) for plain legacy behavior. -->
- **Gate cap:** 20

• Confidence: 97% confidence
• Finding: <!-- autonomous = low recitation, no completion gate. gated = completion gate active (Stop hook may hold the turn until the in_progress phase clears). Omit the mode (or no .mode file) fo

Session Persistence

Medium

• Category: Rogue Agent

Content

The attestation is written to `.planning/<active-plan>/.attestation` (parallel-plan mode) or `./.plan-attestation` (legacy mode). When set, the injected context also carries a `Plan-SHA256:` line so the model can log the attested hash for audit.

For the `attest-plan.sh` write path, optional `flock` guard, macOS and Windows Git Bash fallback, and why slug-mode is preferred for parallel sessions, see [attestation locking and fallback](../../docs/attestation-locking.md). For the transient SHA cache (location, keying, container behavior, and how to clear it), see [performance notes](../../docs/perf-notes.md).

### v3 hardening

• Confidence: 79% confidence
• Finding: write path, optional `flock` guard, macOS and Windows Git Bash fallback, and why slug-mode is preferred for parallel sessions, see [attestation locking and fallback](../../docs/attestation-locking.md)

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.