context-surfing

Pass

Audited by Gen Agent Trust Hub on Apr 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to interact with the environment and external tools. It invokes entire status and entire explain for session state management. It also includes a local bash script, scripts/handoff-checker.sh, designed to run via UserPromptSubmit hooks to detect existing session handoff artifacts.
  • [EXTERNAL_DOWNLOADS]: The documentation references the Entire CLI hosted on GitHub as a dependency for enhanced session tracking. It also provides an installation command using npx to fetch the skill from the author's repository.
  • [PROMPT_INJECTION]: The skill implements a mechanism that automatically loads and processes 'handoff' files from the .context-surfing/ directory. These files are intended to preserve state between sessions, but because they are read into the context verbatim, they represent an indirect prompt injection vector if the local filesystem is compromised.
  • Ingestion points: Relative file paths matching .context-surfing/handoff-*.md.
  • Boundary markers: Uses <context-surfing-handoff> XML tags in the checker script to delineate handoff information for the agent.
  • Capability inventory: Access to entire CLI tools and execution of local shell scripts.
  • Sanitization: The skill lacks explicit sanitization or validation of the content within handoff files, relying on verbatim ingestion of previously generated instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 24, 2026, 03:31 AM