ai-session-save
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill summarizes the current conversation history, which serves as an ingestion point for untrusted user-supplied data. While the skill includes instructions to redact sensitive information, it lacks mechanisms to sanitize or ignore adversarial instructions embedded in the chat that could be propagated into the export block.
- Ingestion points: The workflow involves analyzing the entire current session conversation history to extract tasks, decisions, and work state (SKILL.md).
- Boundary markers: The output is encapsulated in a block fenced with four backticks (````) to ensure data integrity during copy-pasting.
- Capability inventory: The skill utilizes local shell commands (
git rev-parse,git status) and provides functionality to write the session export to a local file (SKILL.md). - Sanitization: The skill contains specific rules to redact secrets, tokens, and private keys, but does not explicitly filter for prompt injection patterns in the summarized content.
Audit Metadata