weekly-checkin
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
datecommand using Bash to retrieve the current system time. This is used strictly for generating accuratecreated:timestamps in the YAML frontmatter of the check-in documents. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from multiple sources.
- Ingestion points: Reads files from
01-daily/briefs/,02-personal/braindumps/,03-professional/braindumps/, and04-projects/*/braindumps/. - Boundary markers: None; the skill lacks explicit delimiters or instructions to ignore embedded commands within the scanned braindump files.
- Capability inventory: The skill can execute local Bash commands (via the
datecall) and has the permission to write new markdown files to the01-daily/checkins/directory. - Sanitization: No evidence of content sanitization or validation was found for the data read from external files before it is processed for reflection and document generation.
Audit Metadata