skills/bigdra50/skills/worklog/Gen Agent Trust Hub

worklog

Pass

Audited by Gen Agent Trust Hub on Jul 5, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled shell script collect.sh to aggregate information from Claude Code sessions and Git logs. It also utilizes standard system commands such as mkdir for directory management, git for commit history retrieval, and open to display generated HTML reports.
  • [EXTERNAL_DOWNLOADS]: The collect.sh script identifies the dependency on the jq JSON processor. If the utility is not found on the system, it provides instructions for the user to install it using a package manager (e.g., brew). The skill does not perform any automated remote script executions or downloads from untrusted sources.
  • [PROMPT_INJECTION]: The skill ingests data from local Claude Code session logs (.jsonl files) which contain historical user messages. This constitutes an indirect prompt injection surface. However, the skill only processes this text to generate summaries and does not execute or evaluate the content as instructions, and it includes logic to truncate extracted text, which significantly limits the risk of adversarial influence on the agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 5, 2026, 01:15 PM
Security Audit — agent-trust-hub — worklog