wrap-up-session
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several shell commands and local scripts to perform its tasks.
- Executes git commands:
git status,git diff,git log,git stash,git push,git worktree list,git fetch,git rev-list. - Executes GitHub CLI commands:
gh pr view,gh issue list,gh pr list. - Invokes local scripts located in the user's home directory:
node ~/.claude/scripts/memory-audit.jsand~/.claude/scripts/spaced-rep.sh. - Checks for background processes using
nohup,pm2, andscreen. - [INDIRECT_PROMPT_INJECTION]: The skill has a defined surface for indirect injection via project configuration files.
- Ingestion points: The skill is instructed to read
CLAUDE.mdin Step 0 and Step 4 to find## Session Wrap-upand## Deploymentsections. - Boundary markers: None. The agent is told to "Execute these steps directly."
- Capability inventory: The agent can perform file writes, network operations (git/gh), and execute arbitrary shell commands.
- Sanitization: None. The agent is directed to run "whatever sync or deploy commands are documented in the project's CLAUDE.md."
- Risk: A malicious contributor could add dangerous commands (e.g., exfiltration scripts) to
CLAUDE.mdwhich the agent would then execute during the wrap-up process. - [DATA_EXFILTRATION]: The skill accesses sensitive local directories and may transmit data.
- Reads from
~/.claude/projects/*/memory/to perform memory deduplication. - Pushes repository content and documentation updates to remote git branches.
- Queries GitHub for issue and PR metadata using
gh.
Audit Metadata