session-wrap
Warn
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes shell commands to analyze the current state of the git repository.
- Evidence: Runs
git status --shortandgit diff --statwithin theSKILL.mdworkflow. - [COMMAND_EXECUTION]: Facilitates the dynamic generation and execution of new automation logic, including commands and agents, based on session analysis.
- Evidence: Step 6 in
SKILL.mdincludes an option to "Create automation" which is defined as "Generate skill/command/agent". - [PROMPT_INJECTION]: Vulnerable to indirect prompt injection (Category 8) where malicious content in the workspace could influence the output of analysis agents.
- Ingestion points: The
Session SummaryinSKILL.mdingests tasks, file changes, and decisions directly from the active coding environment. - Boundary markers: Sub-agent prompts in
SKILL.md(e.g.,doc-updater,automation-scout) do not employ delimiters or warnings to ignore instructions embedded within the session summary data. - Capability inventory: The skill has the ability to write to files (CLAUDE.md), perform git commits, and generate new executable commands or agents.
- Sanitization: There is no evidence of validation or sanitization of the session-derived data before it is interpolated into agent prompts.
- [SAFE]: References design patterns and research from Anthropic, an established and trusted organization.
- Evidence: Cites "Anthropic Multi-Agent Research" and links to official documentation in
references/multi-agent-patterns.md.
Audit Metadata