scratch-cleanup
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and interprets contents from files in the
.scratch/directory and issue trackers to identify 'lasting decisions' and 'efforts', which are then used to generate a cleanup plan.\n - Ingestion points: Files located in
.scratch/(including research, tickets, and unclassified notes),.agents/issue-tracker.md, andtriage-labels.md.\n - Boundary markers: There are no instructions or delimiters specified to prevent the agent from executing instructions found within these files.\n
- Capability inventory: The skill can delete files (
rm,git rm -r), move files (mv,git mv), and interact with the GitHub API (gh api), as specified in the 'Judge each effort' and 'Apply' sections.\n - Sanitization: While SHAs are limited to hex characters, other data such as commit subjects and general file content are processed without sanitization or validation.\n- [COMMAND_EXECUTION]: The skill uses shell commands with variables derived from the repository's file system and history.\n
- Evidence: In Step 2, the command
git log <default-branch> --fixed-strings --grep=\"$(git log -1 --format=%s <sha>)\" -1uses command substitution. A malicious commit message could attempt to inject shell commands.\n - Evidence: Step 4 uses file paths derived from the inventory in commands like
git rm -r -- <path>. Filenames containing shell metacharacters could lead to unintended command execution if not properly handled by the execution environment.
Audit Metadata