checkpoint-work

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill manages state capsules that are read and updated across sessions, which introduces a potential vector for malicious instructions to influence the agent if the state files are compromised.
  • Ingestion points: The agent reads existing capsules from .agents/state/continuity/work-items/<work-item-id>/semantic.md before performing updates.
  • Boundary markers: Uses structured YAML frontmatter and specific Markdown headings defined in SCHEMA.md to organize and delimit state data.
  • Capability inventory: Authorized for file system reads/writes and execution of the local cli.mjs runtime tool.
  • Sanitization: The instructions explicitly require the redaction of credentials, tokens, cookies, private keys, and personal data before saving state.
  • [COMMAND_EXECUTION]: The skill directs the agent to interact with a local CLI tool (.agents/universal-agent-skills/runtime/cli.mjs) using specific commands (activate, checkpoint) to manage state lifecycle and validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:02 AM
Security Audit — agent-trust-hub — checkpoint-work