Agent Economy ReportAgent Economy ReportCAUTION version 3.18.0 · audited 2026-09-17
Planning-with-files is a file-based planning skill for multi-step AI-agent work. It installs lifecycle hooks that run shell scripts automatically on prompts, tool use, stop, and compaction events to read selected project planning files and inject bounded context into the model. The package also creates and updates planning files, writes attestation hashes and ledgers, can read local agent session history only when explicitly requested, and can optionally block stopping in gated mode. It contains no runtime network upload path or credential-theft behavior in the reviewed files. However, it executes shell hooks automatically and injects file contents that may be externally influenced; the skill itself warns that this is prompt-injection sensitive. Overall the behavior matches the declared planning purpose, but advanced modes and local-history replay warrant review, so the verdict is CAUTION.
Instructions try to steer the agent beyond the declared purpose. SKILL.md line 469 states delimiter framing 'does not eliminate prompt injection: the model still parses the content.' SKILL.md line 462 states 'External material copied into planning files remains untrusted.' Plan and progress file data is injected into model context on relevant hook events.
| Declared purpose | Persistent file-based planning for multi-step AI-agent work: keeps task_plan.md, findings.md, and progress.md on disk; lifecycle hooks inject selected project planning context; explicit session-catchup.py --metadata emits aggregate counts only and --replay may emit bounded excerpts; optional gated mode may request continuation only on capable hosts; the skill has no network upload path. |
| Observed behavior | Lifecycle hooks dispatch to scripts/skill-hook.sh and inject-plan.sh/.py. These resolve an active plan under .planning/ or the project root, read bounded snapshots of task_plan.md, progress.md, ledgers, and attestation files, then emit framed plan/progress data into model context. init-session creates planning files and optional .mode/.nonce/.stop_blocks sidecars. attest-plan.sh writes SHA-256 hashes. ledger-append writes JSONL ledger entries. check-complete.sh can emit a block decision in gated mode. session-catchup.py has explicit --metadata/--replay modes; inject-plan.py invokes ledger-summary.sh and session-catchup.py as local subprocesses. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec; reads credential-like environment variables: GKEY, GKEY_SRC, LOCK_TOKEN, TURN_KEY; uses sudo, rm -rf or dd |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | Lifecycle hooks execute sh scripts on UserPromptSubmit, PreToolUse, PostToolUse, Stop, and PreCompact events, and the Python twin runs ledger-summary.sh via subprocess. Shell execution is core to the declared context-injection behavior. |
| filesystem_read | needed | Reads project planning files, .planning state, attestation files, ledgers, cache markers, and optionally local agent session history in explicit session-catchup modes. |
| filesystem_write | needed | Creates task_plan.md, findings.md, progress.md, .planning directories, .mode/.nonce/.stop_blocks sidecars, attestation files, ledger JSONL files, and user-cache progress markers. |
| network | exceeds purpose | No runtime network upload path was observed; SKILL.md line 3 states 'The skill has no network upload path.' Referenced domains in markdown are documentation links. |
| other | needed | Registers lifecycle hooks that inject selected project file content into model context and, in opt-in gated mode, emit a Stop block decision on capable hosts. |
| severity | finding |
|---|---|
| info | Declared purpose The skill declares itself as a file-based planning helper with lifecycle hook injection, explicit local history read modes, optional gated continuation, and no network upload path. SKILL.md:3 Persistent file-based planning for multi-step AI-agent work. Keeps task_plan.md, findings.md, and progress.md on disk; lifecycle hooks inject selected project p |
| info | Allowed tools include Bash The skill requests the Bash tool in addition to read/write/edit and search tools, which is consistent with its shell-script hooks but should be reviewed by the user. SKILL.md:5 allowed-tools: "Read Write Edit Bash Glob Grep" |
| medium | Explicit replay can emit local session excerpts With explicit user invocation, session-catchup.py --replay may emit bounded same-project agent session excerpts into context. The skill warns these excerpts remain untrusted data. SKILL.md:57 $(command -v python3 || command -v python) "${SKILL_DIR}/scripts/session-catchup.py" --replay "$(pwd)" |
| medium | Session-catchup can read local host session store When explicitly requested, the skill reads local agent session records, including an OpenCode SQLite database. This is local-only and same-project, but it is a sensitive capability to review. SKILL.md:274 - `scripts/session-catchup.py`: With explicit `--metadata` or `--replay`, reads same-project records from the active host store. OpenCode uses the read-only SQL |
| medium | Gated mode can block stopping In opt-in gated mode, the Stop event can block termination on host tiers that support hard blocking. This is a notable behavior change from the default advisory-only stop behavior. SKILL.md:379 | Stop event | Advisory only, never blocks | Advisory only, never blocks | Completion gate may block (host-aware) | |
| info | File read/write scope The skill reads and writes planning files and .planning state in the current project, matching its declared file-based planning purpose. SKILL.md:461 - The skill reads and writes `task_plan.md`, `findings.md`, `progress.md`, and optional `.planning/` state in the current project. |
| medium | External content may reach model context Plan and progress file content is injected into context. The skill explicitly warns that external material copied into planning files remains untrusted, which is the main prompt-injection surface. SKILL.md:462 - Activated hooks place selected project planning data into model context. External material copied into planning files remains untrusted. |
| medium | Prompt injection risk is acknowledged The skill's own documentation states delimiter framing does not eliminate prompt injection because the model still parses injected content. SKILL.md:469 1. **Delimiter framing (v2.36.1).** Plan content is wrapped in BEGIN/END markers and tagged as data. Reduces the surface but does not eliminate prompt injection |
| low | Local subprocess runs ledger-summary.sh The Python injector runs ledger-summary.sh through sh on staged ledger snapshots. This is local execution tied to the declared ledger summarization behavior. scripts/inject-plan.py:1286 [sh, lsum_sh, ledger_dir], |
| low | Session start invokes session-catchup.py On SessionStart, the dispatcher runs session-catchup.py with --no-history, meaning it does not read host history in that automatic path. scripts/inject-plan.py:1525 [sys.executable, self.catchup_py, "--no-history", shell_pwd()], |
| low | Cleanup uses rm -rf on snapshot directory The cleanup path removes a snapshot directory with rm -rf. The code says the directory is assigned only by mktemp, but rm -rf is worth review in an automated hook. scripts/inject-plan.sh:605 rm -rf -- "$LEDGER_SNAPSHOT_DIR" 2>/dev/null || : |
| low | Gated mode marker written during initialization When gated mode is selected, init-session writes a .mode file containing 'autonomous gate'. This enables the stronger v3 behaviors, including default attestation and the Stop gate. scripts/init-session.sh:197 printf 'autonomous gate\n' > "${_mode_dir}/.mode" |
2 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| github.com | not in the service index | SKILL.md:474 |
| manus.im | not in the service index | reference.md:218 |
| Binaries invoked | bash, chmod, dd, git, npx, powershell, python, python3, rm -rf, sh |
| Environment variables read | ACTIVE_FILE, ACTUAL, AGENT, ARG_DIR, ATT, ATTEST, ATTEST_FILE, ATTEST_SNAPSHOT, BASE_ID, BLOCKS, BLOCKS_FILE, BOUNDED_TRUNCATED, BYTES, CANON, CAP, CHECK_AMBIGUITY, CHECK_COMPLETE, CLAUDE_PLUGIN_ROOT, CLAUDE_SKILL_DIR, CODEX_SESSIONS_DIR, CODEX_THREAD_ID, COMPETING, COMPLETE, COMPLETE_INLINE, COMPLETE_PRIMARY, CONTEXT, DATE, EVENT, EXPLICIT, FAST_PATH, FILES_CSV, FILES_JSON, FOUND_SURFACE, GATE, GATED, GATE_STOP, GKEY, GKEY_SRC, GUARD, HOME, HOOK_PAYLOAD, IFS, INJ, INJECT_PLAN, IN_PROGRESS, IN_PROGRESS_HEADING, IN_PROGRESS_INLINE, IN_PROGRESS_PRIMARY, LEDGER_FILE, LEDGER_NOW, LEDGER_PREV, LEDGER_SNAPSHOT_DIR, LOCK_ACQUIRED, LOCK_DIR, LOCK_FILE, LOCK_ROOT, LOCK_TOKEN, LOST_C, LOST_X, LSUM_SH, MODE, MODE_FILE, MSYS2_ENV_CONV_EXCL, NEEDS_ATTEST, NESTED_LIST, NESTED_N, NEWEST, NEWEST_MT, NEW_BLOCKS, NEW_STATUS, NORM_OUT, NOW_C, NOW_X, OLD_IFS, OPENCODE_DATA_DIR, OUT, PARSED_IDENTITY, PATH, PENDING, PENDING_INLINE, PENDING_PRIMARY, PHASE, PHASE_ESC, PHASE_ESCAPED, PHASE_NAME, PHASE_NUM, PID, PLANNING_DISABLED, PLAN_AMBIGUOUS, PLAN_COUNT, PLAN_DIR, PLAN_FILE, PLAN_ID, PLAN_LINE_COUNT, PLAN_LINE_TRUNCATED, PLAN_PREFIX, PLAN_ROOT, PLAN_SNAPSHOT, PLAN_VIEW, PRECHECK_PLAN_FILE, PREVIOUS_COUNTS, PREV_C, PREV_X, PROGRESS_FILE, PROGRESS_LINE_COUNT, PROGRESS_LINE_TRUNCATED, PROGRESS_SEMANTIC_TRUNCATED, PROGRESS_SNAPSHOT, PROGRESS_SOURCE_SNAPSHOT, PROJECT_NAME, PROMPT_ID, PSC, PSS, PSV, PWD, PWF_FAST_PATH, PWF_GATE_CAP, PWF_INJECT, PWF_PLAN_GUARD, PWF_PLAN_ROOT, PWF_PYTHON, PWF_ROOT_PIN, PWF_SESSION_ID, PWF_SHELL_PWD, PWF_SKILL_DIR, PWF_TRUSTED_PYTHON, PYTHON_BIN, RAW_PROGRESS, RAW_VIEW, RES, RESOLVED, RESOLVED_DIR, RESOLVER, ROOT_MODE_FILE, ROOT_REAL, ROOT_REAL_SET, SCOPE, SCRIPT_DIR, SESSIONS_DIR, SESSION_ATTACHED, SESSION_ID, SKILL_DIR, SKILL_ROOT, SLUG, SLUG_MODE, SMART, SNAP_ROOT, SOURCE_PLAN_FILE, STDIN_JSON, STOP_HOOK_ACTIVE, SUMMARY, SUMMARY_ESC, TAMPERED, TARGET, TEMPLATE, TEMPLATE_DIR, TMPDIR, TMP_FILE, TOTAL, TOTAL_ENTRIES, TURN_KEY, UID, USE_PLAN_DIR, VALID_EVENTS, XDG_CACHE_HOME, XDG_DATA_HOME |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 8 |
| base64 blobs | 0 |
| File writes | 20 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 506 | 4813ba6c65f2bcaa… |
_meta.json | 6 | 30988be932f84338… |
examples.md | 202 | 930b18a2360cfce5… |
reference.md | 218 | cf1c0639ce33373d… |
scripts/attest-plan.ps1 | 509 | 568c3e5fce3b9614… |
scripts/attest-plan.sh | 257 | 280d4ce9ba303d65… |
scripts/check-complete.ps1 | 268 | c325e999c29190b9… |
scripts/check-complete.sh | 284 | f2ea29577555243f… |
scripts/gate-stop.sh | 32 | ed4f138ccd9ec727… |
scripts/init-session.ps1 | 230 | 4d854b872b925541… |
scripts/init-session.sh | 417 | c35d70ab28338eef… |
scripts/inject-plan.py | 1601 | 3d42048b9166a2b2… |
scripts/inject-plan.sh | 1372 | ab52341164d2ed6e… |
scripts/ledger-append.ps1 | 189 | 8d78d0f451f645f4… |
scripts/ledger-append.sh | 346 | d918315f8b73a2a1… |
scripts/ledger-summary.ps1 | 143 | 5f483af95e025368… |
scripts/ledger-summary.sh | 171 | 064486ba5c0519eb… |
scripts/phase-status.ps1 | 247 | 59d8e7d823293117… |
scripts/phase-status.sh | 212 | 3eb6cee61556bc23… |
scripts/plan-doctor.sh | 170 | 5eb43fdc3da4f94f… |
scripts/resolve-plan-dir.ps1 | 209 | 324afa73a0c08fe4… |
scripts/resolve-plan-dir.sh | 360 | e3ae9980527500b5… |
scripts/session-catchup.py | 983 | a4a30a4de2d55136… |
scripts/set-active-plan.ps1 | 301 | 93b2b9cf85bff131… |
scripts/set-active-plan.sh | 329 | 30d689c4ccd35439… |
scripts/skill-hook.sh | 465 | 923aa675c840c7cb… |
skill-card.md | 60 | 1b3b1a474fd3cd2c… |
templates/analytics_findings.md | 67 | cd46495d0a7d59f1… |
templates/analytics_task_plan.md | 81 | 9339e575779a2e04… |
templates/findings.md | 47 | bb9237ccbf08148d… |
templates/loop.md | 37 | 26b3f2bd8094c6e2… |
templates/progress.md | 58 | 28fc357000ed2b18… |
templates/task_plan.md | 89 | 3c4b61444270f689… |
templates/task_plan_autonomous.md | 98 | 5a93e639a15a3d0e… |
The package exceeded the reading budget; the AI saw a truncated copy. The deterministic pass covered every text file.
For agents
JSON: https://agenteconomy.report/k/planning-with-files.audit.json · badge: https://agenteconomy.report/k/planning-with-files.audited.svg ·
skill rating: /k/planning-with-files · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).