Planning With Files

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:38 PM UTC
• Version: 1.0.0

Overview

This planning skill appears purpose-aligned, but it needs review because it broadly persists task context to project files and documents mutable remote install commands.

Review before installing. Use a pinned, reviewed installation source where possible, expect it to create persistent markdown files in your project root, and avoid using it on tasks involving secrets, credentials, personal data, or sensitive research unless you are prepared to redact and clean up those files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Remote Package Installation Commands

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:22
• README.md:29
• README.md:35

Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:22:

bash

npx clawhub@latest install planning-with-files

README.md:29:

bash

npx add https://github.com/wpank/ai/tree/main/skills/meta/planning-with-files

README.md:35:

bash

npx clawhub@latest install planning-files

Technical Analysis

The documented installation commands instruct users to execute remotely retrieved package code through npx without pinning it to a reviewed, immutable version.

The @latest tag is mutable and may resolve to different package content after this Skill has been audited. The GitHub installation source is similarly not pinned to a commit SHA. No checksum, lockfile, provenance attestation, or signature-verification procedure is provided.

The documentation also uses inconsistent package identifiers: planning-with-files in SKILL.md and planning-files in README.md. This inconsistency increases the risk that users install an unintended package and could create exposure to dependency confusion or typosquatting.

No evidence was found that the currently reviewed local scripts contain malicious code. The vulnerability arises from trusting mutable external dependencies at installation time.

Attack Path

1. An attacker compromises the referenced registry package or upstream repository, publishes a malicious version under a mutable tag, or registers an unintended package matching the inconsistent identifier.
2. A user follows one of the documented installation commands.
3. npx resolves and downloads the current remote package rather than a previously reviewed immutable artifact.
4. The downloaded package's CLI implementation or lifecycle scripts execute with the permissions of the invoking user.
5. Malicious package code can access resources available to that user, alter proje ...[truncated 981 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version:

bash

npx clawhub@3.2.1 install planning-with-files

The example version must be replaced with a release that has actually been reviewed and approved.

2. Pin repository-based installation sources to a specific commit SHA rather than a mutable branch or directory URL.

3. Publish and document checksums or signed provenance attestations for approved artifacts. Verify them before installation.

4. Use lockfiles and integrity metadata wherever the installation workflow supports them.

5. Disable dependency lifecycle scripts with --ignore-scripts when compatible with the installer. If scripts are required, document and review each script before execution.

6. Reconcile planning-with-files and planning-files so every installation example uses one verified package identity.

7. In CI or other sensitive environments, run installation in a sandbox or least-privileged container without production credentials, sensitive host mounts, or unnecessary network access.

8. Avoid recommending mutable tags in security-sensitive documentation. Update dependencies through an explicit review process rather than resolving the newest release automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (10)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

- Core pattern (filesystem as persistent memory)
- Three planning files: task_plan.md, findings.md, progress.md
- Four-phase workflow (create planning files → execute with discipline → handle errors → verify completion)
- The 2-Action Rule for saving findings
- The 3-Strike Protocol for error handling
- 5-Question Reboot Test for context verification

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx add against a GitHub URL without pinning to an immutable version, tag, or commit. That creates a supply-chain risk: if the upstream repository changes or is compromised, future installs may fetch different code than originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The command npx clawhub@latest install planning-files explicitly tracks latest, which is mutable and can resolve to unreviewed code over time. In an agent/tooling environment, this increases the risk of silently introducing malicious or unsafe behavior through an upstream package update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/planning-with-files .claude/skills/planning-with-files

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/planning-with-files ~/.claude/skills/planning-with-files

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: planning-with-files
model: reasoning
version: 3.0.0
description: >
  File-based planning for complex tasks. Use persistent markdown files as working memory

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest remote package version at install time rather than a pinned, reviewed release. That creates a supply-chain risk: a compromised upstream package or unexpected breaking change could result in untrusted code execution on the user's machine.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill repeatedly directs the agent to persist 'anything important,' 'ALL discoveries,' browser-returned data, errors, and prior session context, then re-read those files in later sessions. In a planning/memory skill, that broad instruction materially increases the chance of storing secrets, personal data, proprietary content, tokens, or sensitive research results on disk and resurfacing them later without minimization or user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to create and continually update task_plan.md, findings.md, and progress.md in the project root without an explicit warning or consent checkpoint. In practice this can cause unintended writes into a user repository, pollute working trees, or persist information the user did not expect to be stored on disk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a file-based planning skill that uses markdown files as working memory for complex tasks. Line L63 documents a benign planning step (re-reading the plan before major decisions) using the phrase "attention manipulation," which implies a different intent than ordinary task tracking and can misrepresent the purpose of the instruction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.