cxs
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions guide the user to download and install a CLI tool from the author's GitHub repository at github.com/catoncat/cxs.
- [COMMAND_EXECUTION]: The agent performs shell execution of the 'cxs' binary and 'sqlite3' for indexing and metadata projection, employing 'sqlite3 -readonly' to minimize risks.
- [PROMPT_INJECTION]: The skill processes historical session data which constitutes an indirect prompt injection surface. This risk is inherent to the tool's purpose of searching past conversations and is mitigated by the instruction to treat retrieved content as evidence. * Ingestion points: Output from 'read-range' and 'read-page' commands. * Boundary markers: Instructions explicitly differentiate between metadata and content evidence. * Capability inventory: Local shell access for 'cxs', 'sqlite3', and 'jq'. * Sanitization: No specific filtering of history content is mentioned, relying on agent reasoning.
Audit Metadata