lov-checkpoint-list

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill operates as intended for project log summarization without exhibiting malicious patterns.\n- [PERSISTENCE]: The skill manages a local configuration store via scripts/profile_store.py, saving data to standard locations such as ~/.config/agent-skills/profile.json. This is used to maintain durable records and user preferences between sessions.\n- [DATA_EXPOSURE]: The profile management script includes a security mechanism that filters out sensitive keys (e.g., 'token', 'secret', 'api_key', 'password') before writing to the local store, effectively mitigating the risk of accidental credential harvesting.\n- [DYNAMIC_EXECUTION]: The skill includes local Python scripts (profile_store.py and validate_skill.py) for administrative tasks. These scripts use standard libraries and operate on local data without performing remote execution or unsafe evaluations.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from .checkpoint_log and Git history. It mitigates potential injection risks from malformed log entries by employing a robust JSONL parser that handles line-by-line errors gracefully.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 09:46 AM
Security Audit — agent-trust-hub — lov-checkpoint-list