session-telemetry
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local files including Claude Code session transcripts (
/.claude/projects) and OpenCode databases (/.local/share/opencode/opencode.db). These files contain private user interactions, model reasoning, and potentially code or environment secrets. Although the skill operates locally and has no network exfiltration capabilities, the access to these paths is highly sensitive.\n- [COMMAND_EXECUTION]: The script scripts/telemetry.py invokes the git binary via subprocess.run to retrieve project metadata, identify the repository root, and analyze commit history for reverts. Arguments are passed as a list to prevent shell injection, but the skill still relies on external binary execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes session transcripts and plan files, which are considered untrusted external data. A malicious or compromised session could include adversarial text patterns (such as forged Stop: markers) to manipulate the resulting telemetry reports.\n - Ingestion points: reads JSONL transcripts, SQLite database records, and Markdown plan files (scripts/telemetry.py).\n
- Boundary markers: The script does not utilize explicit delimiters or ignore-instructions to isolate analyzed content.\n
- Capability inventory: The skill executes git commands and performs file writes to a local ledger in the user's home directory.\n
- Sanitization: Content is parsed using standard JSON and SQL libraries, but the extracted text is not sanitized against adversarial instruction patterns.
Audit Metadata