read-agent-sessions
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides detailed instructions and recipes for executing local shell commands, including
ls,find,grep,jq, andsqlite3, to interact with local application data stores. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted historical conversation data, creating a surface for indirect prompt injection.
- Ingestion points: Reads transcripts and metadata from local directories such as
~/.claude/,~/.codex/,~/.zcode/, and~/.hermes/. - Boundary markers: The skill uses specific
jqfilters and SQL queries to isolate message content, but does not provide explicit instructions to ignore potentially malicious commands embedded within the historical conversation text itself. - Capability inventory: The skill uses file system discovery tools and database queries to retrieve session data.
- Sanitization: While it filters for human-readable roles (e.g.,
role: user), there is no explicit sanitization or escaping of the text content before it is processed by the agent for summarization or takeover tasks.
Audit Metadata