retro
Warn
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to read data from sensitive local paths in the user's home directory.
- Evidence: In
SKILL.md, step 2 directs the agent to search through session logs in~/.claude/projects/and~/.codex/sessions/. - Evidence: Step 3 refers to reading configuration data from
~/.config/ox/models.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical session logs, which creates a surface for indirect prompt injection attacks where the agent might follow instructions embedded in past conversations.
- Ingestion points: Session logs located in
~/.claude/projects/and~/.codex/sessions/(as specified inSKILL.md). - Boundary markers: Absent; the instructions do not specify the use of delimiters or warnings to ignore embedded instructions within the logs during analysis.
- Capability inventory: The skill utilizes file reading capabilities to analyze session history and repository configuration files (e.g.,
package.json,.luarc.json). - Sanitization: Absent; there is no mention of escaping or validating the content retrieved from the logs before processing.
Audit Metadata