brag-doc
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes
git log --author=<user> --since="1 month ago"to retrieve commit history for drafting accomplishment entries. - [DATA_EXPOSURE_EXFILTRATION]: Accesses the local file
~/.claude/state/periscope/contributions.log.mdto retrieve logs of agent-assisted contributions. This access is restricted to the local filesystem and is necessary for the skill's stated purpose of tracking professional influence. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from git logs and contribution logs that may contain untrusted strings from commit messages or PR titles.
- Ingestion points: Output from
git logand the content ofcontributions.log.md(inSKILL.md). - Boundary markers: Absent; the instructions tell the agent to "take it at face value and convert it to impact."
- Capability inventory: File system write access to
projects/side/brag/for document creation. - Sanitization: Absent; the skill relies on the agent's interpretation of logs to generate prose.
Audit Metadata