context-manager
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection where malicious instructions hidden in project files could be summarized and passed to continuation agents.\n
- Ingestion points: The skill is configured with broad read access to all project files via
shared_read: ["*"]in SKILL.md.\n - Boundary markers: The YAML handoff structure in SKILL.md does not define explicit delimiters or instructions to prevent the agent from obeying instructions embedded within the
continuation_contextortask_statefields.\n - Capability inventory: The skill context includes access to
Bash,Write,Edit, andReadtools as listed in the allowed-tools section of SKILL.md.\n - Sanitization: The instructions and the compaction guide (references/compaction-guide.md) lack requirements for sanitizing or escaping content read from the environment before including it in the session handoff.
Audit Metadata