agent-run-forensics
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to parse and analyze historical session transcripts which contain untrusted data from past interactions. This creates a surface for indirect prompt injection where malicious instructions stored in logs could influence the agent during a forensics review.
- Ingestion points: Transcripts are read from
~/.claude/projects/and~/.codex/sessions/viascripts/trace_finder.pyandscripts/trace_timeline.pyand processed as input for the agent. - Boundary markers: The skill suggests a template for forensic answers but does not provide explicit instruction to wrap transcribed content in delimiters (like XML tags) with warnings to ignore embedded instructions.
- Capability inventory: The skill provides access to local session logs and the ability to execute the included Python analysis scripts.
- Sanitization: The
trace_core.pyscript includes a comprehensive redaction system for secrets (API keys, tokens, PII), but it does not sanitize the natural language content of the transcripts for potential malicious instructions.
Audit Metadata