recall
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to access and read sensitive session logs and chat histories stored in the local file system, specifically targeting paths like
~/.claude/projects/and~/.codex/sessions/. While this is essential for context reconstruction, these files typically contain sensitive project information, technical decisions, and potentially credentials or private data from previous sessions.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting large amounts of untrusted data from external sources such as chat histories, issue trackers, and user reports. These sources could contain malicious instructions that the agent might inadvertently execute.\n - Ingestion points: Processes
.jsonlsession logs from~/.claudeand~/.codexdirectories, as well as data from issue trackers and chat channels.\n - Boundary markers: The instructions lack specific requirements for robust delimiters or boundary markers (e.g., XML tags or special markers) to isolate ingested content from the agent's core instructions.\n
- Capability inventory: The skill utilizes file system access,
git, andghtools, and spawns subagents to process the data, providing multiple avenues for potential exploitation.\n - Sanitization: While the skill advises sanitizing private context before public output, it does not mandate specific technical sanitization or validation of the ingested external content.
Audit Metadata