optimize-ai-setup
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files, including session logs, skill definitions, and memory markdown files, which are technically untrusted sources that could contain embedded instructions. However, the risk is minimal due to the skill's limited capabilities and focused auditing purpose.
- Ingestion points: The scripts process session logs (transcript.py), SKILL.md files (skillfiles.py), and markdown memory files like CLAUDE.md (memory.py).
- Boundary markers: The agent is directed by SKILL.md to use the compact report generated by the script rather than raw logs, providing a layer of abstraction.
- Capability inventory: The skill performs local file reads and data aggregation. It lacks network access, arbitrary shell command execution, or code evaluation capabilities.
- Sanitization: io.py contains the is_forbidden_path function which prevents reading sensitive files like .env or auth.json. The read_text_capped function limits the amount of data read from any single file.
Audit Metadata