session-viewer
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate utility for rendering session logs from various AI agents.
- [COMMAND_EXECUTION]: The skill uses
child_process.spawnto open the generated HTML file in the system's default browser. The implementation correctly passes the file path as an argument array and avoids using a shell, which mitigates command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data from JSONL files. It implements extensive HTML escaping and sanitization within its custom Markdown renderer and template generation logic to prevent cross-site scripting (XSS) when viewing transcripts.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill reads session files from standard agent directories (Codex, Claude, OpenClaw) and writes them to a local HTML file as requested by the user. No unauthorized data access or external network exfiltration patterns were detected.
Audit Metadata