project-notebook
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMPERSISTENCECOMMAND_EXECUTIONOBFUSCATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill modifies the global agent configuration file (~/.claude/settings.json) to install persistent SessionStart and SessionEnd hooks. These hooks ensure that specific commands are executed automatically at the beginning and end of every agent session.
- [COMMAND_EXECUTION]: The installed hooks execute local scripts (session-start.sh and session-end.sh) which in turn invoke a local 'pj' binary via the Node.js runtime. Additionally, the test suite (tests/test_project_hooks.py) uses subprocess.run to execute the projector script during validation.
- [OBFUSCATION]: The skill includes Python scripts (session-start.sh and session-end.sh) that use a shell script extension (.sh) despite containing Python code. While this is documented as a compatibility measure, misleading file extensions are a common technique for masking script content.
- [DYNAMIC_EXECUTION]: The projector script (scripts/project-hooks.py) dynamically generates and patches JSON configuration fragments into the agent's settings at runtime. It uses atomic write-and-replace patterns and content-addressed snapshots to manage these updates.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it processes repository manifests and project notes which could contain malicious instructions. The skill attempts to mitigate this by instructing the agent to use structured JSON communication and check symbolic error codes.
- Ingestion points: Reads repository manifests and notebook entries via 'pj notebook' commands in references/configuration.md.
- Boundary markers: Instructions in SKILL.md mandate the use of '--json' and validation of 'ok' and 'next_actions' fields.
- Capability inventory: File system writes to configuration and state directories in scripts/project-hooks.py, and execution of local binaries via subprocess calls in hooks/session-start.sh.
- Sanitization: Hook wrappers in hooks/session-start.sh scrub the execution environment and enforce strict input size limits (1MB).
Audit Metadata