show-me-your-work
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEDATA_EXFILTRATIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions direct the agent to access and read sensitive local session history and transcripts located in
~/.claude/projects/and~/.codex/sessions/for auditing purposes. - [PRIVILEGE_ESCALATION]: The skill requests the creation of a sub-agent (
pstack-judge) withfull-accesspermissions and specific high-resource configurations (thinkingOptionId: xhigh) to perform reviews. - [INDIRECT_PROMPT_INJECTION]: The auditing workflow ingests untrusted data from session transcripts and external evidence (such as PR titles or file contents) which are then processed by the 'judge' sub-agent.
- Ingestion points: Reads transaction logs and session JSONL files from user home directories (SKILL.md).
- Boundary markers: The skill does not define clear delimiters or instruction-bypass protections for the sub-agent review phase.
- Capability inventory: The skill utilizes
list_profiles,create_agent, and file-read operations across the audit workflow. - Sanitization: While
scripts/log.shprovides robust sanitization for spreadsheet injection, the agent itself does not perform sanitization on historical transcript data before it is re-processed by the judge model.
Audit Metadata