{"data":{"skill":{"slug":"zhanlincui-planning-with-files","name":"planning-with-files","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/planning-with-files","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"c78c7712-2abc-44c6-b0f6-1bacb743a39e","skill_id":"89e5ed24-b2c2-4ca8-8e50-5b523c30de21","version":2,"content_hash":"c00ef4c93cc3f79e5293f85f4504259a","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis reported many command execution, weak cryptography, network, storage, and heuristic combination findings. Review found most high and critical hits are false positives from markdown examples, headings, file names, and documentation URLs, but the skill does include real local shell hooks and scripts. No evidence found of credential theft, data exfiltration, obfuscation, or prompt injection; publish with a warning about automatic local hooks and workspace file writes.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"scripts/init-session.sh","line_end":120,"line_start":1},{"file":"scripts/check-complete.sh","line_end":43,"line_start":1}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":29,"line_start":13},{"file":"scripts/init-session.sh","line_end":14,"line_start":8},{"file":"scripts/check-complete.sh","line_end":21,"line_start":18}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"scripts/init-session.sh","line_end":113,"line_start":12},{"file":"templates/task_plan.md","line_end":132,"line_start":1}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":12,"line_start":11},{"file":"reference.md","line_end":218,"line_start":215},{"file":"templates/findings.md","line_end":70,"line_start":63}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Automatic Local Shell Hooks","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":29,"line_start":13},{"file":"scripts/check-complete.sh","line_end":43,"line_start":1}],"confidence":0.86,"description":"The skill manifest defines command hooks that run around tool use and stop events. The commands are hardcoded and local, but community shell hooks can read workspace planning content and affect agent workflow.","confidence_reasoning":"The manifest directly registers shell command hooks, and the Stop hook runs the bundled completion script. The commands do not show exfiltration, so the risk is operational rather than malicious."},{"title":"Persistent Workspace File Writes","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/init-session.sh","line_end":113,"line_start":12},{"file":"SKILL.md","line_end":50,"line_start":37}],"confidence":0.82,"description":"The initialization script creates task_plan.md, findings.md, and progress.md in the current project directory. This is intended behavior, but it persists task details and may store sensitive project context if users include it.","confidence_reasoning":"The script clearly writes local markdown files when they do not already exist. The behavior is disclosed and bounded to local files, but persistence of sensitive planning content remains a real consideration."}],"low_findings":[{"title":"False Positive: Documentation Command Blocks","verdict":"FALSE_POSITIVE","locations":[{"file":"examples.md","line_end":53,"line_start":8},{"file":"reference.md","line_end":35,"line_start":31},{"file":"SKILL.md","line_end":60,"line_start":56}],"confidence":0.94,"description":"Most external command detections are markdown examples that show tool names such as Read, Write, WebSearch, and Edit. They are instructional text, not executable Ruby or shell code.","confidence_reasoning":"The flagged content appears inside markdown fences or prose examples. No executable Ruby backtick evaluation is present in these locations."},{"title":"False Positive: Weak Cryptography Heuristic","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":4,"line_start":4},{"file":"reference.md","line_end":7,"line_start":7},{"file":"templates/task_plan.md","line_end":14,"line_start":1}],"confidence":0.91,"description":"The weak cryptography hits align with normal words, headings, and markdown file references rather than cryptographic functions. No hashing or encryption implementation was found in the reviewed files.","confidence_reasoning":"The cited locations are metadata, headings, or template text. They do not contain cryptographic APIs, algorithm selection, or security-sensitive computation."},{"title":"False Positive: Documentation URL and Browser Storage Example","verdict":"FALSE_POSITIVE","locations":[{"file":"examples.md","line_end":117,"line_start":114},{"file":"reference.md","line_end":218,"line_start":215},{"file":"templates/findings.md","line_end":70,"line_start":63}],"confidence":0.9,"description":"The hardcoded URLs are documentation references, and the localStorage mention is an example design decision. No active network request or browser storage access is implemented by the skill.","confidence_reasoning":"The reviewed lines are markdown documentation and templates. They do not execute JavaScript, fetch external resources, or transmit stored data."}],"dangerous_patterns":[{"title":"Manifest-Registered Shell Commands","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":29,"line_start":9}],"confidence":0.88,"description":"The skill requests Bash and configures command hooks in its manifest. The reviewed commands are local and bounded, but marketplace users should be aware that enabling the skill permits automatic shell execution.","confidence_reasoning":"The allowed tools and hook commands are explicit in the manifest. The absence of dynamic command construction or network transfer lowers severity."}],"files_scanned":8,"total_lines":1144,"audit_model":"codex","audited_at":"2026-07-01T03:07:30.579+00:00","created_at":"2026-07-01T04:01:05.580897+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":3,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}