agent-restore-context
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a mechanism to store arbitrary prompt content in hidden files (.agent-restore-context-*) which are automatically re-injected into the agent's context during session resets. While this is the intended functionality for state restoration, it represents an injection surface if untrusted data is written to these files. * Ingestion points: Content is ingested via the $ARGUMENTS parameter in the write action. * Boundary markers: The documentation suggests markdown delimiters (e.g., === RESUMED ===), but these are not programmatically enforced. * Capability inventory: The skill uses Write to create files, Bash for file management, and Read to inspect local configuration files (.claude/settings.json). * Sanitization: No content validation or sanitization is performed on the data written to the restoration files.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform standard file system operations like listing files and managing hidden state files within the project directory.
Audit Metadata