session-pickup
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze potentially untrusted data from session transcripts and checkpoints, which is a known vector for indirect prompt injection.
- Ingestion points: The agent reads supplied checkpoints and transcripts as defined in
SKILL.md. - Boundary markers: The instructions lack explicit delimiters or "ignore instructions" warnings when processing the provided session data.
- Capability inventory: The agent uses its standard toolset to read files, check repository state (branches, PRs), and interact with worktrees.
- Sanitization: No specific sanitization or filtering logic is prescribed for the data extracted from the transcripts.
Audit Metadata