cto-weekly-review
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell scripts (
scripts/collect-git.sh,scripts/collect-ai-sessions.sh,scripts/collect-context.sh) to gather activity data. By default, the git collector searches for repositories across the entire home directory tree up to six levels deep. - [DATA_EXFILTRATION]: The skill accesses highly sensitive local data sources, including shell history (
~/.zsh_history,~/.bash_history) and AI agent session logs from Claude Code, Cursor, and Codex. These files often contain private activity logs, proprietary code discussions, and potentially credentials typed into the terminal. While the data is used to generate a local report, the access profile is broad. - [EXTERNAL_DOWNLOADS]: The HTML report template (
report-template.md) references assets from well-known services, specifically Chart.js from JSDelivr and typography from Google Fonts, to provide visualizations in the generated output. - [PROMPT_INJECTION]: The skill processes external, untrusted data from git logs, shell history, and AI logs to synthesize an engineering narrative. This represents an indirect prompt injection surface.
- Ingestion points: Git logs, shell history files, and AI session logs (
.jsonl). - Boundary markers: The collection scripts use pipe-delimited output, but there are no explicit boundary markers or instructions to the agent to ignore embedded commands within the ingested text during the synthesis phase.
- Capability inventory: File system write access (writing reports to the output directory) and subprocess execution (shell scripts).
- Sanitization: No explicit sanitization or filtering of the content extracted from logs is performed before it is processed by the agent.
Audit Metadata