cx-plan

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local system commands like git rev-parse --show-toplevel and mkdir -p to manage project paths and organize documentation directories.
  • [COMMAND_EXECUTION]: It calls a local script ${CLAUDE_PLUGIN_ROOT}/scripts/cx-worktree.sh to perform state checks on the current feature worktree before proceeding.
  • [PROMPT_INJECTION]: The skill ingests and processes content from project documentation files (PRDs and design documents), which presents a surface for indirect prompt injection. Ingestion points: Reads documentation files from the local repository (e.g., 需求.md, 设计.md). Boundary markers: No explicit delimiters or boundary instructions are utilized to isolate the processed data from the agent's instructions. Capability inventory: The skill performs local file system writes, directory creation, and git operations. Sanitization: Ingested documentation content is processed without explicit sanitization or validation, allowing for a potential surface where embedded instructions in those files could influence the planning output.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 06:15 AM