ldm-session-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes package-local Python scripts (
scripts/export_transcript.pyandscripts/export_jsonl_transcript.py) to automate the retrieval of session data. This is a standard administrative function for this skill's use case. - [DATA_EXFILTRATION]: The skill accesses local agent storage paths including
~/.hermes/state.db,~/.claude/projects/, and~/.codex/sessions/to read chat transcripts. While these paths contain sensitive session history, all operations are performed locally without network activity. - [INDIRECT_PROMPT_INJECTION]: The skill re-introduces historical conversation data into new sessions via a 'Restart Prompt', creating a potential vector for instructions from past logs to influence future agent behavior.
- Ingestion points: Session logs and databases stored in
~/.hermes/,~/.claude/, and~/.codex/. - Boundary markers: The skill does not employ explicit delimiters or safety instructions in the generated restart prompt to prevent the agent from obeying instructions embedded in the archived text.
- Capability inventory: File system read/write access and execution of local Python scripts.
- Sanitization: Content is truncated to 3000 characters, but no specific filtering is applied to detect or neutralize malicious prompt patterns within the historical data.
Audit Metadata