session-memory
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the .claude/state/agent-trace.jsonl file. This file contains metadata and paths for all previous tool executions, exposing the agent's internal history to the current context.
- [COMMAND_EXECUTION]: Recommends using shell commands such as tail and jq to extract information from log files. While used for legitimate context processing, this pattern involves executing subprocesses on locally stored history files.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from previous sessions without proper isolation.
- Ingestion points: Reads from .claude/memory/session-log.md, .claude/memory/decisions.md, .claude/memory/patterns.md, .claude/memory/context.json, and .claude/state/agent-trace.jsonl.
- Boundary markers: Absent. The skill does not define delimiters to separate historical data from current instructions.
- Capability inventory: The skill uses Read, Write, and Edit tools, and provides examples of bash command execution via tail and jq.
- Sanitization: Absent. There is no mention of filtering or escaping content read from historical logs before it is summarized for the agent.
Audit Metadata