session-startup
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from local project files (CLAUDE.md, tasks/todo.md, tasks/lessons.md), creating a surface for indirect prompt injection attacks. Malicious instructions embedded in these files could be executed or followed by the agent during the startup sequence.
- Ingestion points: reads CLAUDE.md, tasks/todo.md, and tasks/lessons.md using Bash and Read tools.
- Boundary markers: Absent. The skill does not use delimiters or instructions to ignore embedded prompts within the retrieved content.
- Capability inventory: The skill is configured with access to the Bash and Read tools, which provide file system access and command execution capabilities.
- Sanitization: Absent. There is no validation or filtering of the content retrieved from project files before it is processed by the agent.
Audit Metadata