developer-growth-analysis
Warn
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the sensitive local file path
~/.claude/history.jsonl. - This file contains detailed records of the user's past interactions, including source code, project architecture, and potentially sensitive information pasted during development sessions.
- The skill is designed to process this data and transmit a summary to an external Slack workspace using the
RUBE_MULTI_EXECUTE_TOOL. - [PROMPT_INJECTION]: The skill is highly susceptible to Indirect Prompt Injection (Category 8).
- Ingestion points: Accesses
~/.claude/history.jsonl, which contains untrusted text from previous chat sessions. - Boundary markers: No specific delimiters or "ignore instructions" warnings are implemented to prevent the agent from being influenced by malicious prompts found within the history file.
- Capability inventory: Includes file reading (
history.jsonl), external web searching (HackerNews), and network-based data transmission (Slack). - Sanitization: The skill does not sanitize or escape the content ingested from the chat history before processing it for the report.
- An attacker could poison the history file in a prior session with instructions to exfiltrate the entire history file or perform other unauthorized actions when this analysis skill is later invoked.
- [COMMAND_EXECUTION]: The skill utilizes an external tool named
RUBE_MULTI_EXECUTE_TOOL. While the stated purpose is to deliver the report to Slack, the "multi-execute" nature of the tool suggests it possesses broad operational capabilities within the environment that could be abused if the agent is compromised via prompt injection.
Audit Metadata