history-insight
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of shell commands including
find,jq,stat, andsplitto manage and process session data. - [DATA_EXFILTRATION]: The skill accesses sensitive conversation logs located in
~/.claude/projects/. These files contain a history of user interactions, including code and potentially sensitive data, which are then processed and displayed. The scope can be extended to all projects on the system. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from past session logs and passes it to subagents for analysis.
- Ingestion points: The skill reads
.jsonlsession files from the local file system (~/.claude/projects/). - Boundary markers: There are no explicit delimiters or instructions provided to the subagent to ignore or treat the session content as untrusted data.
- Capability inventory: The skill utilizes shell execution, file system access, and subagent invocation (
Task). - Sanitization: The
extract-session.shscript filters message types but does not sanitize the text content of the messages themselves.
Audit Metadata