pre-compact
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill modifies global agent instruction files located in the home directory, such as
~/.claude/CLAUDE.mdorAGENTS.md. By inserting instructions that direct future agents to trust specific handoff files over session summaries, it implements a persistent change to the agent's operating environment. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between sessions, ingesting potentially untrusted data from a current conversation to influence future ones.
- Ingestion points: Aggregates "Findings", "Decisions", and "Undone instructions" from the active conversation context into a structured Markdown file.
- Boundary markers: The handoff file uses Markdown headers to separate sections, but there are no specific markers instructing future agents to treat the copied session content as untrusted or to ignore embedded instructions within that content.
- Capability inventory: The skill possesses file-write capabilities to the project's
.agents/directory and the user's home directory configuration files. - Sanitization: The skill includes a specific security instruction to avoid recording secrets, tokens, or passwords, but it does not mandate sanitization or escaping of the session data to prevent cross-session prompt injection attacks.
Audit Metadata