exploring-claude-sessions
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill provides instructions and recipes to access sensitive local data in the ~/.claude/ directory, including session transcripts and prompt history. This exposes private user interactions and internal agent 'thinking' blocks to the agent.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local session logs which may contain malicious instructions from previous conversations or external sources read by tools in those sessions.
- Ingestion points: Transcript files in ~/.claude/projects/ and global history in ~/.claude/history.jsonl (referenced in SKILL.md and data-model.md).
- Boundary markers: Absent. Data is extracted via jq and grep and presented directly without delimiters or instruction-ignore headers.
- Capability inventory: Shell command execution via Bash tool (jq, ls, grep, find, claude) as defined in SKILL.md.
- Sanitization: Absent. Text content from transcripts is interpolated into the agent context without escaping or validation.
Audit Metadata