continue-claude-code-work
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The file
.security-scan-passedcontains an authoritative claim ("Security scan passed") that attempts to pre-determine the safety status of the skill. This is a deceptive pattern because conclusions about safety must rely on the analyzer's own findings rather than claims embedded within the skill content. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted external data, which creates a potential vulnerability surface.
- Ingestion points: The skill reads external session history via the
daymade-claude-code:read-claude-code-historytool and parses project-level files such asAGENTS.mdandCLAUDE.md(found inSKILL.md, Step 1 and Step 3). - Boundary markers: While the skill uses a "continuation contract" to organize evidence, it lacks explicit delimiters or instructions to ignore potential malicious instructions embedded within the history data.
- Capability inventory: The skill is authorized to "execute the business task" and take "next direct actions" based on the history, which likely includes file modifications and command execution (found in
SKILL.md, Step 4). - Sanitization: There are no mechanisms mentioned for sanitizing, escaping, or validating the content of the retrieved history before it influences the agent's logic.
Audit Metadata