wrap-up-session

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes several shell commands and local scripts to perform its tasks.
  • Executes git commands: git status, git diff, git log, git stash, git push, git worktree list, git fetch, git rev-list.
  • Executes GitHub CLI commands: gh pr view, gh issue list, gh pr list.
  • Invokes local scripts located in the user's home directory: node ~/.claude/scripts/memory-audit.js and ~/.claude/scripts/spaced-rep.sh.
  • Checks for background processes using nohup, pm2, and screen.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a defined surface for indirect injection via project configuration files.
  • Ingestion points: The skill is instructed to read CLAUDE.md in Step 0 and Step 4 to find ## Session Wrap-up and ## Deployment sections.
  • Boundary markers: None. The agent is told to "Execute these steps directly."
  • Capability inventory: The agent can perform file writes, network operations (git/gh), and execute arbitrary shell commands.
  • Sanitization: None. The agent is directed to run "whatever sync or deploy commands are documented in the project's CLAUDE.md."
  • Risk: A malicious contributor could add dangerous commands (e.g., exfiltration scripts) to CLAUDE.md which the agent would then execute during the wrap-up process.
  • [DATA_EXFILTRATION]: The skill accesses sensitive local directories and may transmit data.
  • Reads from ~/.claude/projects/*/memory/ to perform memory deduplication.
  • Pushes repository content and documentation updates to remote git branches.
  • Queries GitHub for issue and PR metadata using gh.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:32 PM