recall
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses local chat transcripts stored in the
${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects/directory. These files contain a full history of previous interactions, which may include sensitive user information or code.\n- [COMMAND_EXECUTION]: The skill performs several local command-line operations:\n - Executes a specific Node.js script located at
<plugin>/skills/reflect/scripts/claude-project-dir.mjsto determine the session directory.\n - Uses system and developer tools including
ls,git, andghto inspect the local filesystem and remote repository state.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: The skill reads and processes data from external, potentially untrusted sources including source control history, issue trackers, external chat/issue channels, and historical
.jsonlchat transcripts.\n - Boundary markers: The instructions lack explicit directives for the agent to use delimiters or ignore instructions embedded within the ingested data.\n
- Capability inventory: The skill has the capability to execute shell commands (
git,gh,ls), run Node.js scripts, and spawn multiple subagents to process the retrieved content.\n - Sanitization: While the skill advises the agent to sanitize private context before public output, it does not provide mechanisms for sanitizing or validating the input data before it is incorporated into the agent's active reasoning context.
Audit Metadata