agent-conv-cli
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
README.mddocumentation includes instructions to install theuvtool by piping a script fromastral.shto a shell (curl -LsSf https://astral.sh/uv/install.sh | sh).astral.shis the official domain for Astral, the developers of theuvandrufftools. - [DATA_EXFILTRATION]: The skill accesses local directories containing sensitive conversation histories, such as
~/.claude/projects/,~/.codex/sessions/, and the Cursor editor's storage directory. This access is the primary intended function of the skill, which acts as a unified reader for these histories. - [COMMAND_EXECUTION]: The
agent-convscript executes external binaries includingclaudeandcodexto support thread forking and porting functionality. It usesos.execvpandsubprocess.runto transition execution to these tools. - [INDIRECT_PROMPT_INJECTION]: The skill ingests historical conversation data that is later used to seed new agent sessions. This presents a potential attack surface where instructions found within the processed history could be interpreted by the target agent.
- Ingestion points: Conversation logs are read from local filesystem paths associated with agent installations (e.g.,
SKILL.md,bin/agent-conv). - Boundary markers: When porting history between providers, the content is delimited using triple-dash
---markers to separate context from instructions. - Capability inventory: The tool has the ability to spawn new shells and execute agent binaries using history as context.
- Sanitization: The script implements logic to strip internal system tags, thinking blocks, and synthetic turns from the conversation stream during display.
Audit Metadata