session-wrap

Warn

Audited by Gen Agent Trust Hub on Mar 4, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands to analyze the current state of the git repository.
  • Evidence: Runs git status --short and git diff --stat within the SKILL.md workflow.
  • [COMMAND_EXECUTION]: Facilitates the dynamic generation and execution of new automation logic, including commands and agents, based on session analysis.
  • Evidence: Step 6 in SKILL.md includes an option to "Create automation" which is defined as "Generate skill/command/agent".
  • [PROMPT_INJECTION]: Vulnerable to indirect prompt injection (Category 8) where malicious content in the workspace could influence the output of analysis agents.
  • Ingestion points: The Session Summary in SKILL.md ingests tasks, file changes, and decisions directly from the active coding environment.
  • Boundary markers: Sub-agent prompts in SKILL.md (e.g., doc-updater, automation-scout) do not employ delimiters or warnings to ignore instructions embedded within the session summary data.
  • Capability inventory: The skill has the ability to write to files (CLAUDE.md), perform git commits, and generate new executable commands or agents.
  • Sanitization: There is no evidence of validation or sanitization of the session-derived data before it is interpolated into agent prompts.
  • [SAFE]: References design patterns and research from Anthropic, an established and trusted organization.
  • Evidence: Cites "Anthropic Multi-Agent Research" and links to official documentation in references/multi-agent-patterns.md.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 4, 2026, 11:03 AM