audit-skills
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local files to perform its audit, including chat histories and platform state information.\n
- Evidence: The
scripts/audit-skills.mjsscript reads session histories from~/.codex/sessions,~/.claude/projects, and~/.cursor/projects, and queries the SQLite database at~/.codex/sqlite/state_5.sqlite.\n- [COMMAND_EXECUTION]: The script executes therg(ripgrep) utility viaBun.spawnto search through session histories.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session histories to generate an audit report for the agent.\n - Ingestion points: The
scripts/audit-skills.mjsscript scans.jsonlsession files across multiple agent platforms.\n - Boundary markers: Absent. Data from logs is parsed and summarized into a report without specific delimiters to prevent the agent from misinterpreting embedded text.\n
- Capability inventory: File system read/write, local command execution (
rg), and SQLite database queries.\n - Sanitization: Skill names are regex-escaped, but the underlying user and assistant message content in history logs is not sanitized.
Audit Metadata