Planning with files

• Outcome: Pass
• Latest audit: Sep 5, 2026 · 9:21 PM UTC
• Version: 3.16.1

Overview

The skill is a disclosed file-based planning helper with hooks and local state that match its purpose, with install and optional history-reading cautions.

Install from ClawHub or a pinned, verified source revision when possible. Expect this skill to add project planning files and lifecycle hook context injection. Use session-catchup --replay only when you are comfortable exposing bounded same-project transcript excerpts to the agent context, and use gated mode only when you want the host to resist stopping until the plan says work remains.

A.I.G

By Tencent

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:281
• Finding: Unpinned Executable Installer and Mutable Skill Source## Vulnerability Details **File Location**: `SKILL.md:281` **Vulnerability Type**: Supply-chain risk from an unpinned executable dependency and mutable source reference **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown | `npx skills add OthmanAdi/planning-with-files` (or ClawHub) | SKILL.md, scripts, templates only | No, follow the manual fallback below | ``` ### Technical Analysis The documented installation command invokes `npx` without specifying an exact version of the `skills` package. Depending on local npm behavior and cache state, `npx` can retrieve and execute a package version from the registry at installation time. The effective installer code can therefore differ from the version evaluated during this audit. The skill source is also identified as `OthmanAdi/planning-with-files` without an immutable commit hash, verified release artifact, or integrity digest. If the installation tool resolves that reference through a mutable branch or tag, the installed scripts and lifecycle hooks can change after review. This creates a time-of-check versus time-of-use supply-chain boundary: reviewing the present artifact does not establish the integrity of the package and repository content later retrieved by the documented command. No evidence indicates that the current project contains a malicious dependency; the vulnerability is the absence of version and integrity controls around executable installation. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the referenced source repository, or another mutable distribution component. 2. The attacker publishes a malicious package version or replaces content resolved through the mutable repository reference. 3. A user follows the documented `npx skills add OthmanAdi/planning-with-files` installation procedure. 4. `npx` retrieves and executes the then-current installer package, which may not be the version previously audited. 5. Th ...[truncated 805 chars]
• Remediation: ## Remediation Suggestions 1. Pin the `skills` installer to an audited exact version, for example by using an explicit package version rather than an unqualified `npx skills` invocation. 2. Pin `OthmanAdi/planning-with-files` to an immutable commit hash or a cryptographically verified release artifact. 3. Publish SHA-256 digests or signed provenance for the installer and skill package, and verify them before installation. 4. Prefer a lockfile-controlled, preinstalled installer over downloading and executing a package on demand. 5. Run installation with least privilege in a sandbox or restricted account, without unnecessary credentials or sensitive environment variables. 6. Document the exact trusted package version, source revision, expected digest, and verification procedure in `SKILL.md`. 7. Add automated release checks that reject documentation containing unpinned executable installation commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The description narrows the skill to a few planning files and 'no network upload path,' but the body documents substantially broader behavior: additional persistent state, host-local session store inspection, replay of bounded prior transcript excerpts, and diagnostic/environment probing. This mismatch is dangerous because users and hosts may grant trust based on the concise description while the skill actually accesses more sensitive local data and writes more control files than implied.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.