session-cleanup
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git commands, process termination, and file deletion to perform its primary function. While these are legitimate actions for a cleanup tool, they represent significant capabilities directed by workspace state.
- [INDIRECT_PROMPT_INJECTION]: The skill inventories and classifies external data, creating an attack surface where malicious filenames or process metadata could influence the agent.
- Ingestion points: The skill reads file paths, background process lists, and browser page titles into the agent's context during the inventory phase (SKILL.md).
- Boundary markers: There are no specific delimiters or 'ignore embedded instructions' markers used when the agent processes these external strings.
- Capability inventory: The skill has the capability to stop processes and delete directories or files (SKILL.md).
- Sanitization: Risk is mitigated by a mandatory human-in-the-loop confirmation step before any deletion or process termination is executed.
Audit Metadata