agent-session-capture-backup
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses sensitive local directories containing private session history and transcripts from multiple AI agents, including Pi (
/.pi/agent/sessions), Claude (/.claude/projects), and Codex (~/.codex/sessions). - [CREDENTIALS_UNSAFE]: Accesses local authentication databases and secret files (~/.joelclaw/capture-auth.db, ~/.joelclaw/auth.json) to manage session capture permissions across the infrastructure.
- [COMMAND_EXECUTION]: Executes local TypeScript scripts using the bun runtime and modifies shell profile files (.zshrc, .zprofile) and configuration files (~/.config/system-bus.env) to configure environment variables.
- [PROMPT_INJECTION]: Ingests and processes untrusted data from agent session transcripts which presents a surface for indirect prompt injection. Ingestion points: Agent session capture files and run history JSONL files. Boundary markers: None identified in the skill instructions. Capability inventory: File system read/write via rsync, shell configuration modification, script execution, and network communication to a central API. Sanitization: None identified for the outbox replay process.
Audit Metadata