recall
Warn
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive local files containing full chat transcripts stored at
~/.claude/projects/. These files hold the history of all interactions within a project, which may include previously shared credentials, secrets, or private data.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and historical data that could contain malicious instructions designed to influence the agent's behavior during context reconstruction.\n - Ingestion points: Chat history transcripts (
~/.claude/projects/<encoded-cwd>/<uuid>.jsonl), issue trackers, source control history, and error tracking systems.\n - Boundary markers: The skill lacks explicit markers or instructions to ignore or delimit embedded commands within the ingested data.\n
- Capability inventory: Access to the local filesystem (
ls,grep), version control systems (git,gh), and the ability to spawn parallel subagents for data processing.\n - Sanitization: There is no evidence of input filtering or sanitization for the ingested records; the instructions only specify sanitizing output for privacy.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands including
ls -tandgrepto perform automated searches and sorting of local transcript files.
Audit Metadata