scout-pro
Warn
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local directories at
~/.claude/, including session history (session-context.md), project memory, and a custom usage log. These files contain private conversation data and session metadata. While no explicit exfiltration was found, the skill possesses network tools (WebFetch,WebSearch) that could be used in conjunction with this sensitive data access. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources that it does not control, creating a surface for injection attacks.
- Ingestion points: Processes content from
~/.claude/rules/session-context.md,~/.claude/projects/, and variousSKILL.mdfiles within the/Users/gabe/claude-skills/directory. - Boundary markers: Absent; there are no instructions to the agent to treat the ingested data as untrusted or to ignore embedded instructions within the history or external skills.
- Capability inventory: File system access (
Read,Glob,Grep), network capabilities (WebFetch,WebSearch), and the ability to orchestrate multi-skill chains. - Sanitization: Absent; the skill does not perform validation, escaping, or filtering of the content it reads before using it to generate recommendations.
- [COMMAND_EXECUTION]: The skill generates and recommends 'chains' of other skills and commands. This orchestration capability increases the potential impact of an injection attack, as the agent could be directed to execute a sequence of actions that compromise the local environment.
Audit Metadata