show-me-your-work
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts that contain untrusted inputs from users and external tools to generate logs and summaries. Malicious content within a transcript could potentially influence the agent's audit results or the subsequent subagent review.
- Ingestion points: Local session directories including
~/.claude/projects/,~/.pi/agent/sessions/,~/.codex/sessions/, andagent-transcripts/. - Boundary markers: None specified. The agent reads and processes raw transcript files without explicit delimiters or warnings to ignore embedded instructions.
- Capability inventory: Appending to files via
scripts/log.sh, reading local session history, and spawning subagents for review. - Sanitization: The
scripts/log.shutility includes logic to escape characters (=,+,-,@) that could be interpreted as formulas if the resulting TSV is opened in spreadsheet software. - [DATA_EXFILTRATION]: To perform its 'Cross-model review', the skill instructs the agent to read local session history and transcripts and send that data to a subagent on a different model family. This constitutes the sharing of potentially sensitive local session data with external model providers.
- [COMMAND_EXECUTION]: The skill uses a local bash script (
scripts/log.sh) to manage the decision log. The script is well-designed with security in mind, utilizing safe string handling and sanitization to prevent both TSV structure corruption and command injection.
Audit Metadata