coding-agent-sessions
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/agent_sessions/opencode.pyinvokes theopencodecommand-line tool usingsubprocess.runto retrieve session information and database paths. The execution is limited to the local binary and uses list-based arguments with a defined timeout. - [DATA_EXFILTRATION]: The skill accesses potentially sensitive local session data and transcripts stored in directories such as
~/.claude,~/.codex,~/.opencode,~/.cursor, and~/.pi. This access is necessary for the skill's primary function of reconstructing user agent history. - [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by ingesting untrusted transcript data from local files and returning it to the agent context.
- Ingestion points: Transcripts are read in
claude.py,codex.py,opencode.py,aside_scanner.py, andfile_scanners.py. - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions are present when interpolating transcript content into the prompt.
- Capability inventory: Includes
subprocess.run(opencode.py) and various SQLite query capabilities. - Sanitization: Content is extracted and returned as raw text without validation or escaping.
Audit Metadata