transcripts
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of session logs from previous interactions, which serves as a potential source for indirect prompt injection if the historical data contains malicious instructions.
- Ingestion points: Directs the agent to read JSONL transcript files in
~/.claude/projects/,~/.codex/sessions/,~/.cursor/projects/,~/.omp/agent/sessions/, and~/.pi/agent/sessions/. - Boundary markers: Includes specific privacy instructions in
SKILL.mdthat limit access to the current workspace and forbid wider directory searching. - Capability inventory: The skill contains no executable scripts or dynamic code; it functions solely as an instructional guide for path discovery.
- Sanitization: There are no instructions for sanitizing the input from the retrieved transcript files.
Audit Metadata