egyptian-session-report
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The HTML template references the 'Cairo' font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). This is a well-known service used for styling and does not represent a security risk.
- [COMMAND_EXECUTION]: The workflow requires executing
git status,git diff, andgit logto collect session facts. These operations are limited to local workspace inspection and are required for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from git logs and file changes to populate the report.
- Ingestion points: Git command outputs and session task lists are used as the source of truth.
- Boundary markers: Instructions specify that the agent must only report work that actually happened and label uncertain work as assumptions.
- Capability inventory: The skill can execute shell commands for git and write a local file (
session-report.html). - Sanitization: The skill relies on the agent to summarize and group changes into meaningful tasks rather than directly dumping raw logs, though explicit technical sanitization of the generated HTML content is not defined.
- [DYNAMIC_EXECUTION]: The skill generates a new HTML file by populating a template with session data. This is a standard file generation task for reporting purposes.
Audit Metadata