local-conversation-history
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script
scripts/list_local_history.pyto inventory local chat history. This script is restricted to the local environment and uses only the Python standard library. - [PROMPT_INJECTION]: The skill processes untrusted data from local conversation logs (such as session titles and metadata) to generate its output. This creates a surface for indirect prompt injection where malicious content in a previous chat could attempt to influence the agent when the history is listed.
- Ingestion points:
scripts/_core/claude.pyandscripts/_core/codex.pyread from local JSONL and SQLite history stores. - Boundary markers: The skill outputs Markdown tables and uses a
markdown_escapefunction to sanitize pipe characters and newlines. - Capability inventory: The script is limited to read-only operations on specific history directories; it lacks network access or file-write capabilities.
- Sanitization: Conversation titles are whitespace-normalized, truncated, and escaped before being presented to the agent.
Audit Metadata