exploring-claude-sessions
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directory paths containing session transcripts, command history, and automated memory.
- Evidence: SKILL.md recipes access
~/.claude/projects/,~/.claude/history.jsonl, and~/.claude/file-history/. - These transcripts may contain sensitive information such as API keys, private code snippets, or environment variables previously recorded in Claude Code sessions.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session transcripts which could contain malicious instructions from previous AI interactions.
- Ingestion points: The skill reads JSONL transcript files via
jqandgrepas described in SKILL.md. - Boundary markers: Absent. The recipes extract and display message content without specific delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill uses
Bash(jq, ls, grep) to process and display these files. - Sanitization: Absent. Content is processed as raw text or JSON blocks without filtering for embedded instructions.
- [COMMAND_EXECUTION]: The skill provides recipes that execute shell commands to parse and search local session data.
- Evidence: Employs
jqandgrepto extract, filter, and format conversation history from local files.
Audit Metadata