session-budget
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
wc -cto estimate session size andgit branchto determine project context. It also executes bundled Node.js scripts (mailbox.mjs,budget-hook.mjs) to manage session handoff state. - [PERSISTENCE]: The skill maintains session state across restarts by storing handoff markdown files in a hidden directory (
~/.agent-handoffs) within the user's home folder. This directory is also used for hook state files to throttle notifications. - [INDIRECT_PROMPT_INJECTION]: The skill processes handoff files which are used as briefings for new sessions. This represents an attack surface where data processed by the agent could influence future session behavior.
- Ingestion points: Handoff files located in
~/.agent-handoffs/are read during session initialization. - Boundary markers: Briefings are introduced with a
[session-budget]tag and specific instructional context. - Capability inventory: The agent has access to
Bash,Read, andWritetools to manage these files. - Sanitization: The scripts use basic regex and filename sanitization, but rely on the agent to generate well-formed markdown files.
Audit Metadata