ClawHub
Back to skill

Security audit

Planning with files

Security checks across malware telemetry and agentic risk

Overview

This planning skill is coherent, but it should be reviewed because its recovery workflow can read and replay prior local agent transcripts without per-run confirmation.

Install only if you are comfortable with a planning helper that stores project planning files and may surface prior local agent-session snippets during recovery. Avoid using it in workspaces containing secrets or sensitive chats unless you are prepared to review/disable the catchup workflow and keep planning files under your control; use attestation for long-running or gated plans.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding
The declared description frames the skill as a simple file-based planning helper, but the documented behavior is substantially broader: prompt injection hooks, transcript/session recovery, attestation enforcement, stop-gating, and ledger management. This mismatch is dangerous because users may enable a low-risk sounding skill without realizing it can read historical session artifacts and influence model control flow on every turn.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script prints prior-session user/assistant messages and tool activity directly to stdout during startup, which can expose sensitive prompts, code, secrets, file paths, and command history from earlier sessions without explicit user consent at the time of disclosure. In a persistent planning skill, this is especially risky because the behavior is automatic on SessionStart and may surface context from prior work into a fresh session, logs, terminal scrollback, screen sharing, or other observers.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The notes include explicit attention-shaping language such as 'Re-read this plan before major decisions (attention manipulation)', which is designed to steer agent behavior beyond simple documentation. In a persistent planning skill, this can bias future reasoning across turns and sessions, making it easier for embedded instructions in files to influence agent decision-making in ways the user did not request.

Context Leakage

High
Category
Data Exfiltration
Content
def extract_messages_after(messages: List[Dict[str, Any]], after_line: int) -> List[Dict[str, Any]]:
    """Extract conversation messages after a certain line number."""
    tool_results = collect_claude_tool_results(messages)
    result = []
    for msg in messages:
Confidence
96% confidence
Finding
The function intentionally extracts conversation content and tool results after the last planning-file update, creating a direct context-leak path from stored transcripts into the current session output. Because the skill's purpose is persistent recovery across clears and session loss, it increases the chance of replaying sensitive content from previous sessions, including unrelated secrets or commands, into visible context without robust filtering or consent.

Hidden Instructions

High
Category
Prompt Injection
Content
# Task Plan: [Brief Description]
<!-- 
  WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk."
  WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.
  WHEN: Create this FIRST, before starting any work. Update after each phase completes.
Confidence
86% confidence
Finding
The template embeds operational instructions inside HTML comments, which are not visible in rendered Markdown but are still present in the file and may be consumed by an agent. Hidden instructions in persistent workspace files are risky because they can silently shape behavior, survive context resets, and act as an indirect prompt-injection channel.

Hidden Instructions

High
Category
Prompt Injection
Content
# Task Plan: [Brief Description]
<!--
  WHAT: This is your roadmap for the entire task. Think of it as your "working memory on disk."
  WHY: After 50+ tool calls, your original goals can get forgotten. This file keeps them fresh.
  WHEN: Create this FIRST, before starting any work. Update after each phase completes.
Confidence
96% confidence
Finding
The HTML comments contain operational instructions directed at the agent, including creation timing, update behavior, and persistence goals. Because these instructions are hidden from normal rendered view but still machine-readable, they can act as covert prompt input and influence agent behavior without transparent user visibility.

Hidden Instructions

High
Category
Prompt Injection
Content
-->

## Run Contract
<!--
  WHAT: The rules this run operates under. The orchestrating agent reads this once at the
        top of the run and the gate honors it. None of these change v2 behavior unless a
        mode is explicitly set; default-everything here equals legacy semantics.
Confidence
98% confidence
Finding
This hidden block defines run-governing semantics for the orchestrating agent and gate, including that the agent reads and honors the contract. Hidden policy directives are especially risky because they can silently steer control flow, execution mode, and termination behavior while remaining invisible in normal document rendering.

Hidden Instructions

High
Category
Prompt Injection
Content
these fields mirror. If you hand-edit, keep this block in sync with .planning/<id>/.mode.
-->
- **Mode:** gated
  <!-- autonomous = low recitation, no completion gate. gated = completion gate active (Stop
       hook may hold the turn until the in_progress phase clears). Omit the mode (or no .mode
       file) for plain legacy behavior. -->
- **Gate cap:** 20
Confidence
97% confidence
Finding
This hidden comment provides behavioral semantics for the Mode field, including gate behavior and turn-holding logic. Even though the text frames this as documentation, it is still hidden instruction content that can manipulate autonomous execution characteristics and could be abused if an attacker modifies the template.

Session Persistence

Medium
Category
Rogue Agent
Content
The attestation is written to `.planning/<active-plan>/.attestation` (parallel-plan mode) or `./.plan-attestation` (legacy mode). When set, the injected context also carries a `Plan-SHA256:` line so the model can log the attested hash for audit.

For the `attest-plan.sh` write path, optional `flock` guard, macOS and Windows Git Bash fallback, and why slug-mode is preferred for parallel sessions, see [attestation locking and fallback](../../docs/attestation-locking.md). For the transient SHA cache (location, keying, container behavior, and how to clear it), see [performance notes](../../docs/perf-notes.md).

### v3 hardening
Confidence
79% confidence
Finding
The skill intentionally persists plan state, attestations, and related workflow metadata across sessions, and the document also describes recovering prior session context from transcripts and an OpenCode SQLite store. This is potentially dangerous because persistent artifacts can capture sensitive task context and make it available to later sessions or other local processes if retention, storage location, or access controls are weak.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.