money-restore
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill manages session state by reading from a dedicated application directory (~/.smtm/sessions/). It does not target sensitive operating system paths, credentials, or SSH keys.- [SAFE]: No network exfiltration or remote code execution patterns were detected. All described operations are local file system reads and parsing.- [SAFE]: The instructions include a safety mechanism that prevents the automatic invocation of subsequent skills, explicitly requiring the agent to wait for user confirmation after presenting the restored state.- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests data from external snapshot files.
- Ingestion points: Snapshot files located in
~/.smtm/sessions/{project}/(SKILL.md). - Boundary markers: The skill uses structured parsing logic for YAML frontmatter and specific Markdown headers to isolate data fields.
- Capability inventory: Capabilities are limited to listing directories, reading files, and recommending (but not executing) next steps to the user.
- Sanitization: The agent is instructed to extract and summarize content for the user rather than processing file content as direct commands.
Audit Metadata