session-introspection
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow instructs the agent to "Apply obvious safe controls immediately when possible". Combined with the allowed control types (
script,lint,hook), this provides the agent with a mechanism to write and potentially execute shell scripts or modify environment configurations (like git hooks) automatically without a mandatory human-in-the-loop verification for every script. - [REMOTE_CODE_EXECUTION]: The skill facilitates the dynamic generation of executable content based on session analysis. An attacker could use indirect prompt injection to influence the session history, leading the agent to generate and execute a malicious script or hook under the guise of an "anti-recurrence control".
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted session data (outcomes, friction evidence) to make execution decisions without sufficient safety boundaries.
- Ingestion points: Input fields like 'intended outcome', 'concrete friction', and 'evidence' (SKILL.md).
- Boundary markers: None present in the instructions to separate session data from instructions or to warn the agent about embedded commands.
- Capability inventory: Capability to write to the filesystem and execute/configure scripts and hooks (SKILL.md).
- Sanitization: No validation or sanitization of ingested evidence or generated code is specified in the workflow.
Audit Metadata