wrap
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands
git statusandgit logto analyze recent changes in the project directory. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection as it ingests untrusted data from the session and uses it to update persistent instructions.
- Ingestion points: Reads conversation history,
git logoutput, and files likeWORKBENCH.mdto synthesize session summaries. - Boundary markers: Lacks explicit delimiters or instructions to ignore embedded malicious content within the ingested session data.
- Capability inventory: Possesses file-writing capabilities to project documentation and persistent agent instruction files located in
.claude/skills/. - Sanitization: Does not implement sanitization or validation of the session data before it is interpolated into the agent's instruction set.
- [PROMPT_INJECTION]: The 'AUTO-WRITE' policy for 'Additive skill patches' allows the agent to automatically modify its own persistent instructions. This capability allows malicious session input to be codified as a permanent 'rule' in the agent's skills, bypassing user review and leading to persistent prompt injection that affects all future sessions.
Audit Metadata