lov-checkpoint-list
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes local Python scripts (
scripts/profile_store.pyandscripts/validate_skill.py) used for configuration management and source validation. These scripts are part of the skill package and operate within the local environment to manage a shared user profile. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Git logs and project checkpoint files (
.checkpoint_log). This represents a potential ingestion surface, but the skill defines explicit execution boundaries inSKILL.mdthat prioritize read-only analysis and user-controlled output. - [SAFE]: The
profile_store.pyscript implements a proactive security measure by filtering out sensitive keywords (such as 'token', 'secret', and 'password') to prevent them from being stored in the durable profile context. All external resources and packages identified are consistent with the vendor's own tools and standard developer workflows.
Audit Metadata