tldr
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions by summarizing session history, subagent results, and CI/PR statuses, which are external data sources that could potentially contain malicious instructions. While this creates an injection surface, the risk is mitigated by explicit instructions that limit the skill's capability to read-only operations and require secret redaction.
- Ingestion points: The skill ingests subagent results, messages from other users, and live statuses of CI runs and PRs (referenced in catch-up.md).
- Boundary markers: The skill does not define explicit delimiters to isolate untrusted data within its context.
- Capability inventory: The skill is restricted to read-only operations; it is specifically instructed not to edit code, start applications, or post data to external services (referenced in catch-up.md).
- Sanitization: The skill contains a mandatory rule to redact all sensitive tokens, keys, and passwords, replacing them with placeholders (referenced in SKILL.md).
- [CREDENTIALS_UNSAFE]: The skill includes an explicit security rule to 'Redact secrets' and 'never copy' tokens, keys, passwords, or connection strings found in task outputs or commands. This proactive measure prevents the accidental exfiltration or exposure of credentials in task summaries.
Audit Metadata