meta-packager
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes historical prompt data and shell history to identify reusable patterns. This ingestion of untrusted local data could lead to 'packaging' malicious instructions found in past sessions into new persistent assets.\n
- Ingestion points: Evidence collection from
~/.claude/history.jsonl,sessions-index.json, and shell history files.\n - Boundary markers: The instructions do not define clear delimiters or provide 'ignore instructions' warnings for the data being analyzed.\n
- Capability inventory: The skill has the capability to write new executable assets (skills, subagents, hooks) to the local filesystem or user home directory.\n
- Sanitization: The skill advises against quoting secrets but lacks a mechanism to sanitize instructional content within the ingested evidence.\n- [COMMAND_EXECUTION]: The skill uses local shell commands (
tail,find) to examine history files, project logs, and existing skill directories during the analysis phase.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses sensitive local interaction logs (~/.claude/history.jsonl) which contain user prompts and session data. It limits exposure by instructing the agent not to inspect credential files and requires that data collection remain read-only.
Audit Metadata