session-manager
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands to gather project context.
- Evidence: Executes
git log --oneline -10andgit statusduring the session start and sync phases to synchronize the agent's mental model with the repository state. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of ingesting untrusted repository data.
- Ingestion points: The skill reads project context from
CLAUDE.md, files in.claude/plans/, session state in.workflow/active/, and handoff documents in.workflow/handoffs/(defined inSKILL.md). - Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the ingested files.
- Capability inventory: The skill can execute git commands and perform file read/write operations within the workspace.
- Sanitization: No sanitization or validation of the content within the ingested markdown or JSON files is performed before it is added to the agent's context.
Audit Metadata