prompt-history

Pass

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external AI tool session logs and assistant context to generate pull request documentation.
  • Ingestion points: Data is ingested via the pmtx extract command and the assistant_context metadata field in SKILL.md.
  • Boundary markers: The instructions do not define specific delimiters or instructions to treat the ingested log content purely as data to be summarized.
  • Capability inventory: The skill executes subprocesses (pmtx, gh) and performs file-writing operations to ~/.promptex.
  • Sanitization: No explicit sanitization or filtering logic is provided to ensure that instructions embedded within session logs are not followed by the agent during the rendering phase.
  • [EXTERNAL_DOWNLOADS]: The skill depends on a custom binary called pmtx. Users are directed to install this binary from the author's GitHub repository (github.com/gutierrezje/promptex). While this is identified as a vendor resource, it introduces an external dependency that operates outside the agent's immediate safety filters.
  • [COMMAND_EXECUTION]: The skill utilizes several command-line tools to achieve its functionality. It executes pmtx to verify compatibility and extract historical prompt data, and it uses the GitHub CLI (gh) to retrieve pull request numbers, post comments, and edit pull request descriptions. Additionally, it creates and writes markdown files to the user's local filesystem in the ~/.promptex directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 11, 2026, 05:51 AM