project-session-manager
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates development environments by executing CLI tools such as
git,tmux,jq, and various provider-specific utilities (gh,jira,az,glab,tea). It implements robust path validation to ensure that file deletions (viagit worktree remove) are restricted to authorized directories under the user's home directory. - [EXTERNAL_DOWNLOADS]: The skill clones source code from remote Git hosting providers including GitHub, GitLab, and Bitbucket. These operations are integral to its function and utilize standard authenticated interfaces provided by the platforms.
- [PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection by processing untrusted data from external sources.
- Ingestion points: Fetches PR and issue titles, bodies, and metadata from external providers (GitHub, Jira, etc.) as seen in
psm.shand various provider scripts. - Boundary markers: Untrusted content is interpolated into markdown templates (found in the
templates/directory) and session metadata files without the use of delimiters or isolation instructions. - Capability inventory: The skill possesses capabilities for repository manipulation, session orchestration, and network access via CLI tools.
- Sanitization: While the skill sanitizes parameters for identifiers to prevent shell injection or filesystem errors, the content of PRs and issues is not filtered or escaped before being used in the context of development sessions.
Audit Metadata