checkpointed-agent-loop
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages a task state in a local JSON file which the agent is instructed to read and follow for subsequent actions. This creates an attack surface where malicious instructions could be embedded in fields like 'objective' or 'nextAction'.
- Ingestion points: The loadCheckpoint function in scripts/checkpoint-loop.mjs reads from a user-specified file path at runtime.
- Boundary markers: The documentation does not provide instructions to wrap the command output in delimiters or warn the agent to ignore instructions embedded within the state data.
- Capability inventory: The Node.js utility performs file system operations (readFile, writeFile, mkdir). The agent using the skill typically possesses capabilities to execute shell commands and call other system tools.
- Sanitization: The script performs schema validation (checking for non-empty strings and valid states) but does not sanitize content for prompt injection patterns.
Audit Metadata