aporia-session-notes
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from coding session histories and transcripts (Phase 1) to generate notes, comments, and process maps in Aporia. This presents a surface where malicious content in the session log could influence the agent's output.
- Ingestion points: Reads session history, decisions, and questions as described in
SKILL.md. - Boundary markers: The skill lacks explicit boundary markers or delimiters between processed session data and its own logic, though it does include a 'Discipline gate' to verify rationale.
- Capability inventory: The skill uses high-level MCP tools:
aporia:record_notes,aporia:comment_item,aporia:update_item,aporia:update_node,aporia:attach_file, andaporia:record_processto modify the Aporia map. - Sanitization: There are no technical sanitization or escaping steps defined for the interpolation of session data into the final notes.
- [COMMAND_EXECUTION]: The skill is designed to interact with the
aporiaMCP server, executing multiple tools that modify an external knowledge map based on session activity. While these are managed MCP tools rather than raw shell commands, they grant the agent significant authority to update project documentation and logic.
Audit Metadata