vault-session
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local
git,ls,grep, andmkdircommands to gather project context and manage notes within a hardcoded local vault directory (/Users/tmeister/Vault). The commands are used legitimately to automate note creation and update workflows. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from the local git repository—such as branch names, commit messages, and file diffs—and using it to reconstruct session narratives.
- Ingestion points: Git repository metadata via
git branch,git log, andgit diffinSKILL.md(Workflow Step 1). - Boundary markers: None present; the raw git output is processed and distilled directly into the note template.
- Capability inventory: File system write access via
mkdirand file creation/update logic inSKILL.md(Workflow Step 6). - Sanitization: No sanitization or validation is performed on the data retrieved from git before it is used to generate the session summary.
Audit Metadata