ck
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js scripts located in the skill's commands directory to manage project context. It also invokes the
gitcommand-line tool via subprocesses to summarize repository activity between sessions. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files, including
package.json,README.md, andCLAUDE.md, to automatically populate project descriptions and goals. This data is subsequently injected into the agent's context during the session start hook. A malicious project could include instructions in these files designed to influence or override the agent's behavior when the context is loaded. - Ingestion points:
init.mjsreads project metadata and markdown files;session-start.mjsreadsCLAUDE.md. - Boundary markers: The injected context uses standard Markdown headers but lacks explicit delimiters or instructions to ignore instructions embedded in the project data.
- Capability inventory: The skill can write and delete local files in the user's home directory and execute Node.js and Git commands.
- Sanitization: Content is parsed using regular expressions and basic string manipulation before being stored in JSON context files.
Audit Metadata