recap
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes activity data from pull requests, commit messages, and Basecamp posts, which are untrusted inputs that could contain malicious instructions. \n
- Ingestion points: Reads activity data from JSON files stored in the ~/.cache/recap/ directory. \n
- Boundary markers: The SKILL.md file includes a dedicated Trust Boundaries section that explicitly instructs the agent to treat cached text as data rather than instructions and to ignore any directives found in the content. \n
- Capability inventory: The skill has the capability to execute shell scripts and interact with system-level command-line tools such as git, gh, and basecamp. \n
- Sanitization: It explicitly instructs the agent to summarize activity rather than quoting it verbatim to mitigate the risk of passing through injection payloads. \n- [COMMAND_EXECUTION]: The skill automates data collection and synthesis by invoking local fetcher scripts and standard developer tools, including git, the GitHub CLI (gh), the Basecamp CLI, and jq for JSON processing.
Audit Metadata