collab-proof
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes inline Python and Bash scripts to extract token usage data and generate local HTML documentation.
- [DATA_EXFILTRATION]: Accesses local session history files stored in
~/.claude/projects/. While no network exfiltration was detected, the skill reads sensitive conversation transcripts to extract metadata and session statistics. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git logs, diffs, and conversation transcripts to generate documentation, creating a surface for instruction injection from external data.
- Ingestion points: Reads
git log,git diff, and.jsonlsession logs from~/.claude/projects/(identified in SKILL.md). - Boundary markers: Absent; there are no delimiters or warnings to ignore embedded instructions in the ingested content.
- Capability inventory: The skill has the capability to write to
DECISIONS.md,WORKLOG.md, and create arbitrary HTML files insession-history/(identified in SKILL.md). - Sanitization: Absent; the skill does not escape or validate external content before interpolating it into the generated documentation or narrative summaries.
Audit Metadata