backfill
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reconstructs a knowledge bundle by ingesting data from external sources, specifically git commit history and Claude session transcripts. This creates a surface for indirect prompt injection where malicious content in a repository could influence the behavior of the analysis agents.
- Ingestion points: Data is extracted from git logs and the user's local Claude session transcripts (~/.claude/projects/) via the okf_backfill_events.py script.
- Boundary markers: The extracted data is stored in a structured JSONL format, but the skill instructions do not provide specific delimiters or 'ignore' instructions to the sub-agents to disregard potential malicious directives embedded within the ingested text.
- Capability inventory: The skill has access to Bash, Read, Write, and Edit tools, which it uses to read history and write the reconstructed bundle to the local .okf/ directory.
- Sanitization: The extraction script performs head+tail truncation on text fields to a maximum of 2000 characters to limit the volume of content processed.
- [COMMAND_EXECUTION]: The skill executes local Python scripts and interacts with the git CLI using subprocess.run. The implementation uses list-based arguments, which is a secure practice that prevents shell injection vulnerabilities.
Audit Metadata