writing-plans — agentic threat model

Not certain from the listing — relies on an unspecified foundation model to generate detailed implementation plans. Vulnerable to prompt injection that could silently insert malicious instructions, backdoors, or insecure patterns into the generated software plans.

Not certain from the listing — assumes zero-context but likely ingests codebase structures or file paths. If codebase metadata is poisoned or manipulated, the agent may generate inaccurate or disruptive file-touching plans.

The agent operates as an instruction-only planning framework. While it does not execute tools directly, vulnerabilities lie in the planning logic itself, where an attacker could manipulate the DRY/YAGNI/TDD enforcement rules to generate flawed logic.

Not certain from the listing — deployment details of the hosting environment are unspecified. Because it only outputs text artifacts, it requires minimal infrastructure permissions, reducing host compromise risks compared to execution agents.

Not certain from the listing — no built-in evaluation, logging, or guardrails are mentioned to verify if the generated plan contains malicious code recommendations before passing it to downstream agents.

Not certain from the listing — lacks explicit identity, authorization, or policy controls. It relies entirely on the security posture of the platform hosting the skill and the downstream execution environment.

Designed specifically to shape plans executed by other skills. This creates a strong multi-agent dependency where a compromise or injection in this agent directly propagates downstream to execution agents, leading to cascading failures.