session-evidence
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill explicitly accesses sensitive local database files to extract session history, specifically targeting
~/.codex/state_5.sqliteand~/.codex/sqlite/state_5.sqlite. This allows the agent to read historical transcripts and artifacts which may contain secrets or sensitive data from previous interactions. - [COMMAND_EXECUTION]: Scripts provided in
references/audit-examples.mdutilizenode -eto execute inline JavaScript for parsing JSON output from thesessions analyzecommand. While the logic is functional (calculating result lengths), it involves spawning a Node.js subprocess to evaluate code at runtime. - [PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting untrusted transcript data from previous agent sessions.
- Ingestion points: Transcripts are pulled from local history via the
sessions analyzecommand (SKILL.md). - Boundary markers: Absent. The skill instructions suggest summarizing snippets to maintain privacy but provide no technical delimiters to prevent the agent from obeying instructions found within the logs.
- Capability inventory: The skill uses the
sessionsCLI toolset for local data access and analysis. - Sanitization: None. The content is parsed and reported as matches without filtering for embedded instructions.
Audit Metadata