muster
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads sensitive local files in ~/.claude/projects/ containing transcripts of previous agent sessions. Although this is its core function, it accesses private historical data.
- [COMMAND_EXECUTION]: The skill uses local CLI tools such as git, gh, and ListAgents to verify workspace state and detect peer activity.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted sources including git history, PRs, trackers, and transcripts. Evidence chain: 1. Ingestion points: Git logs, GitHub PR descriptions, issue tracker results, and session transcripts. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified. 3. Capability inventory: Capabilities include reading local files, executing shell commands, and spawning subagents. 4. Sanitization: No content filtering or sanitization is mentioned, relying on subagents to extract findings from raw data.
Audit Metadata