checkpoint-work
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages state capsules that are read and updated across sessions, which introduces a potential vector for malicious instructions to influence the agent if the state files are compromised.
- Ingestion points: The agent reads existing capsules from
.agents/state/continuity/work-items/<work-item-id>/semantic.mdbefore performing updates. - Boundary markers: Uses structured YAML frontmatter and specific Markdown headings defined in
SCHEMA.mdto organize and delimit state data. - Capability inventory: Authorized for file system reads/writes and execution of the local
cli.mjsruntime tool. - Sanitization: The instructions explicitly require the redaction of credentials, tokens, cookies, private keys, and personal data before saving state.
- [COMMAND_EXECUTION]: The skill directs the agent to interact with a local CLI tool (
.agents/universal-agent-skills/runtime/cli.mjs) using specific commands (activate,checkpoint) to manage state lifecycle and validation.
Audit Metadata