finding-skill-opportunities
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill runs local bash scripts (
git-signals.sh,scan-workflows.sh) and a Python script (session-signals.py) to analyze the environment. These scripts are read-only and designed for deterministic data mining based on the local repository and session logs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's git history and the user's local session transcripts, which presents an attack surface for indirect prompt injection.
- Ingestion points: The skill reads commit messages via
git logand processes user prompts and tool interaction history from JSONL files located in~/.claude/projects/. - Boundary markers: There are no explicit markers or specific instructions provided to the agent to distinguish between the script's analytical output and potential malicious instructions embedded within the processed log data.
- Capability inventory: The skill leverages the agent's ability to execute local scripts and synthesize reports. It can access and process files within the repository and the local Claude project configuration directory.
- Sanitization: The Python script uses regex and normalization for statistical analysis (e.g., counting verb/object clusters) but does not implement sanitization to prevent the agent from interpreting ingested text as instructions during the synthesis step.
Audit Metadata