session-search
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdfile instructs the agent to execute a Python script (scripts/search.py) with user-supplied arguments. This is the intended primary purpose of the skill to facilitate session searching. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (previous session transcripts) which could contain adversarial instructions.
- Ingestion points: Files located in
~/.claude/projects/*.jsonlare read and parsed byscripts/search.py. - Boundary markers: None. Excerpts from transcripts are returned to the agent context as raw JSON data.
- Capability inventory: The agent is encouraged to use
claude --resume <session-id>based on the search results, which can load the full context of a potentially poisoned session. - Sanitization: The script performs basic JSON parsing and string truncation but does not sanitize content against prompt injection patterns.
Audit Metadata