checkpoint-resume
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust state management system using local JSON files. It includes a custom locking mechanism (withLock) to prevent race conditions during concurrent writes and uses atomic renames to ensure file integrity.
- [SAFE]: The run-status.mjs utility includes safety measures like shquote to prevent command injection when generating resume commands. It also includes strict validation logic (classifyLaunch) that only permits specific, well-defined coordinator commands to be displayed as runnable, flagging others as migration-only or non-runnable.
- [SAFE]: The workflow-journal.mjs component reads Claude Code's internal journal files from the user's home directory (~/.claude) to provide real-time observability. This access is limited to reading metadata about the current project's sessions and does not involve external data transmission or sensitive credential access.
- [SAFE]: The event-log.mjs module includes protections against prototype pollution by validating property paths against a list of forbidden keys (proto, prototype, constructor).
Audit Metadata