maintain-workflow-context-restore
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a local shell command
ls .claude/checkpoints/*.md | sortto retrieve and order available checkpoint files by their timestamped filenames.- [PROMPT_INJECTION]: The skill processes content from external checkpoint files which represents an indirect prompt injection surface as these files could contain malicious instructions. - Ingestion points: Reads and parses Markdown files with YAML frontmatter from the local
.claude/checkpoints/directory. - Boundary markers: Relies on YAML keys and Markdown headers to structure the data, though it does not explicitly instruct the agent to ignore instructions embedded within the text fields.
- Capability inventory: The skill's own operations are explicitly restricted to read-only file access; however, it recommends a 'Next Command' to the user based on file contents.
- Sanitization: The skill extracts specific metadata fields but does not sanitize the text values within those fields before displaying them or using them for context.
- Mitigation: Includes a mandatory 'Hard Gate' that prohibits the agent from automatically writing code or executing commands without presenting a summary and receiving explicit user confirmation, which serves as a robust defense against autonomous obedience to injected instructions.
Audit Metadata