prompt-history
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external AI tool session logs and assistant context to generate pull request documentation.
- Ingestion points: Data is ingested via the
pmtx extractcommand and theassistant_contextmetadata field inSKILL.md. - Boundary markers: The instructions do not define specific delimiters or instructions to treat the ingested log content purely as data to be summarized.
- Capability inventory: The skill executes subprocesses (
pmtx,gh) and performs file-writing operations to~/.promptex. - Sanitization: No explicit sanitization or filtering logic is provided to ensure that instructions embedded within session logs are not followed by the agent during the rendering phase.
- [EXTERNAL_DOWNLOADS]: The skill depends on a custom binary called
pmtx. Users are directed to install this binary from the author's GitHub repository (github.com/gutierrezje/promptex). While this is identified as a vendor resource, it introduces an external dependency that operates outside the agent's immediate safety filters. - [COMMAND_EXECUTION]: The skill utilizes several command-line tools to achieve its functionality. It executes
pmtxto verify compatibility and extract historical prompt data, and it uses the GitHub CLI (gh) to retrieve pull request numbers, post comments, and edit pull request descriptions. Additionally, it creates and writes markdown files to the user's local filesystem in the~/.promptexdirectory.
Audit Metadata