checkpoint
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from the chat history to generate the
HANDOVER.mdfile and update other project files. This creates a surface where instructions embedded in the chat could be written to disk and potentially executed or misinterpreted by the agent in future sessions. - Ingestion points: Instructions direct the agent to distill the current session state and write "anything important living only in the chat" to files (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore embedded instructions within the summarized content.
- Capability inventory: The skill performs file write operations and executes shell commands via
git. - Sanitization: There is no mention of sanitizing or validating the chat content before it is persisted to the local environment.
- [COMMAND_EXECUTION]: The skill uses shell commands to identify the project structure and manage version control state.
- Evidence: The skill explicitly instructs the agent to run
git rev-parse --show-toplevelandgit committo manage session checkpoints (SKILL.md).
Audit Metadata