agent-restore-context

Pass

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a mechanism to store arbitrary prompt content in hidden files (.agent-restore-context-*) which are automatically re-injected into the agent's context during session resets. While this is the intended functionality for state restoration, it represents an injection surface if untrusted data is written to these files. * Ingestion points: Content is ingested via the $ARGUMENTS parameter in the write action. * Boundary markers: The documentation suggests markdown delimiters (e.g., === RESUMED ===), but these are not programmatically enforced. * Capability inventory: The skill uses Write to create files, Bash for file management, and Read to inspect local configuration files (.claude/settings.json). * Sanitization: No content validation or sanitization is performed on the data written to the restoration files.
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform standard file system operations like listing files and managing hidden state files within the project directory.
Audit Metadata
Risk Level
SAFE
Analyzed
May 16, 2026, 05:39 AM
Security Audit — agent-trust-hub — agent-restore-context