session-to-skill-extractor
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted session logs from various agent platforms via
load_sessions.py. These transcripts are processed by an LLM to identify and articulate procedures. While this presents an indirect prompt injection surface where a transcript could contain malicious instructions, the skill implements a mandatory human review queue (review-queue/) and a manual promotion script (promote.py) which acts as a robust boundary against the automatic installation of malicious or malformed skills. - [COMMAND_EXECUTION]: Several test files (e.g.,
tests/test_filter.py,tests/test_validator.py) utilizesubprocess.run()to execute the skill's own Python scripts for integration testing. These executions are limited to the skill's internal logic and do not involve shell injection or execution of untrusted external commands. - [EXTERNAL_DOWNLOADS]: The
scripts/adapters/devin.pyscript communicates with the official Devin API (api.devin.ai) usingurllib.request.urlopento retrieve session data when an API key is provided. This is a legitimate vendor resource used as intended for the Devin host adapter and does not represent an exfiltration or remote code execution risk.
Audit Metadata