Security audit
Security checks for vulnerabilities and agentic risk
This planning skill is a markdown-only workflow guide that asks clarifying questions and may use research subagents or memory lookup, with no evidence of hidden code, persistence, exfiltration, or destructive behavior.
Before installing, be aware that this skill may activate for many planning-like requests and may consult prior memory or launch research subagents. It does not show hidden execution or persistence, but users who want tighter control should ask the agent to confirm before using memory or spawning research.
The description says to use the skill whenever 'a user proposes a project or task that needs planning,' which is a very wide condition and does not define clear boundaries for when the skill should or should not activate. It also lacks concrete exclusion conditions or negative examples, increasing the risk of unintended invocation during ordinary discussion about tasks or projects.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| ❌ Only providing commands without descriptions | Provide descriptions (consequences + differences + risks, etc.) for every option |
| ❌ Assuming consequences without knowing | Launch subagent research — do not assume directly |
| ❌ Skipping to execution before user decides | Wait for user confirmation before execution |
| ❌ Proceeding to next question without confirmation | Confirm after every selection |
| ❌ Not returning after subagent research | After research completes, must return to the original question |
---