The Agent Skills Directory

Indirect Prompt Injection Surface: The skill analyzes and summarizes session transcripts that could contain untrusted content from external sources or previous interactions. This content is processed by the agent without explicit sanitization, creating a surface where adversarial instructions in a log could influence agent behavior during report generation.
Ingestion points: Analyze-Session.ps1 reads session logs from ~/.copilot/session-state/ and ~/.claude/projects/.
Boundary markers: The generated session-report.md uses standard Markdown formatting (headers, tables, and code blocks) to structure the data, which provides basic delimitation but may not prevent interpretation of embedded instructions.
Capability inventory: The skill environment provides the agent with file system access (view, edit, create) and shell execution (powershell, shell) capabilities, which could be targeted by an injection attack.
Sanitization: The script extracts and formats raw log data (including user prompts and tool outputs) into a report without filtering or escaping potentially malicious instruction strings.
Local Session Data Access: The script accesses local agent session transcripts to extract metrics and turn details. While these files contain sensitive user data (prompts, environment variables, and tool outputs), this access is restricted to vendor-specific directories (.copilot and .claude) and is fundamental to the skill's diagnostic purpose.
Privacy and Transparency Mitigations: The skill includes mandatory privacy notices that the agent must surface to the user. It also provides a clear warning that the generated report is unredacted, encouraging manual review before the user shares the diagnostic data.

winui-session-report