review-session
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts, which are untrusted data sources that could contain malicious instructions designed to hijack the subagent's analysis logic.
- Ingestion points: Reads local session transcripts (.jsonl) and accepts user-provided file paths for analysis.
- Boundary markers: None identified; instructions do not include delimiters or warnings to ignore embedded instructions within the transcript data.
- Capability inventory: Uses the Agent tool to dispatch subagents, reads and writes local files in /tmp, and executes shell commands via python3.
- Sanitization: The skill utilizes a reduce-transcript.py script, but there is no evidence that this script performs safety filtering for adversarial content or prompt injection patterns.
- [COMMAND_EXECUTION]: The skill invokes python3 to execute a script (reduce-transcript.py) located within the plugin's root directory, processing data from potentially user-controlled file paths.
- [DATA_EXFILTRATION]: The skill accesses session transcripts, which are sensitive files containing a full history of user-agent interactions, including source code, environment details, and potentially sensitive configuration data.
Audit Metadata