signal-friction-scan
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the vendor-owned
joelclawCLI along with standard utilities likehostname,find, andrg. These tools are used to query local session metadata and search for patterns within the user's repository paths (specifically~/Code/joelhooks/).- [PROMPT_INJECTION]: The skill ingests and processes agent session transcripts, which represent a surface for indirect prompt injection from potentially untrusted interaction data. - Ingestion points: Session content is retrieved through
joelclaw sessions signals,joelclaw sessions friction, andjoelclaw session inspectinSKILL.md. - Boundary markers: The instructions explicitly advise treating session signals as "radar, not truth" and emphasize synthesis over literal execution of instructions found within history.
- Capability inventory: The skill possesses the capability to execute shell commands and write files to the vendor's repository structure during its second pass.
- Sanitization: The process uses a two-pass workflow where the first pass is strictly observational (synthesis only), and the second pass (creating or patching assets) requires an explicit request from the user.
Audit Metadata