muster
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to access session history and metadata stored in locations like
~/.claude/projects/andsessions/. This enables the agent to read transcripts from previous sessions to rebuild context. The skill incorporates a mandatory scoping step to ensure that the agent only accesses transcripts relevant to the current workspace. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting content from external or shared sources which may contain instructions from untrusted parties.
- Ingestion points: Historical agent transcripts, git logs, GitHub pull request details, and external project trackers.
- Boundary markers: The instructions require the agent to explicitly state the scope of its search ('Lock the scope and say it back'), though no specific formatting delimiters are prescribed for the retrieved data content.
- Capability inventory: The skill utilizes file system access and command-line tools for git and GitHub (gh).
- Sanitization: The skill does not provide specific instructions for sanitizing or filtering retrieved content before it is processed by the agent.
Audit Metadata