The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses node:child_process to open the generated HTML file in the user's default browser (open, start, or xdg-open depending on the platform). This is standard functionality for the tool's intended purpose and is triggered only via the explicit --open CLI flag.
[REMOTE_CODE_EXECUTION]: The skill generates an HTML file with embedded JavaScript for searching and rendering session data. The embedded script is statically defined in scripts/html.ts, and the session data is properly escaped using custom JSON and HTML escaping functions to prevent cross-site scripting (XSS) or data injection when viewing the exported file.
[DATA_EXPOSURE]: The skill accesses local session log files (JSONL) to process them. These paths are provided by the user via CLI arguments. The tool performs local processing only and does not contain any network operations or external exfiltration patterns.
[SAFE]: Analysis of all scripts and utility functions shows proper handling of untrusted session data, including validation of image URLs to prevent javascript: scheme injection and robust parsing of diverse JSONL formats.

session-viewer