recall
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from various external and historical sources which may contain untrusted content.
- Ingestion points: Processes chat history via the
sessionsscript and fetches data from GitHub PRs, branches, and issue trackers usinggit,gh, and thewhyskill. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are implemented for the data being read.
- Capability inventory: The skill has the ability to execute shell commands (
git,gh,sessionsscript) and spawn autonomous subagents. - Sanitization: While the skill instructions mention sanitizing private context for output, there is no evidence of input sanitization or escaping to prevent the agent from obeying instructions embedded in the ingested data.
- [COMMAND_EXECUTION]: The skill utilizes local CLI tools and scripts to gather context and manage state.
- Evidence: Directly invokes
git,gh(GitHub CLI), and a local management script located at../rex-subagents/scripts/sessions.
Audit Metadata