limits-endings
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill includes a shell script (
hooks/endings-context.sh) designed to function as a SessionStart hook in Claude Code. This script automatically injects session-ending instructions into every new session. While persistence mechanisms are often flagged, this is the primary intended purpose of the skill to ensure consistent behavior across all interactions. - [INDIRECT_PROMPT_INJECTION]: Rule 4 allows the agent to perform an optional closing ritual by reading and outputting quotations from a source file provided by the user. This presents a potential surface for indirect prompt injection if the quotation file contains instructions intended to manipulate the agent's behavior.
- Ingestion points: User-provided quotation file (specified in
SKILL.mdRule 4). - Boundary markers: The skill does not define specific boundary markers for the quotation content.
- Capability inventory: The agent reads local files and outputs content to the user session.
- Sanitization: There are no explicit sanitization steps for the quotation content; the skill relies on the user providing a trusted source file.
Audit Metadata