tool-call-diagnose
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external session traces (session-file, calls dump) which are untrusted data. This data is then passed to sub-agents for classification and analysis.
- Ingestion points: Processes session JSONL files and calls dumps via
find-tool-calls.pyandfind-skill-sessions.py(SKILL.md). - Capability inventory: Executes local scripts via
python3, spawns sub-agents usingruns.all, and reads skill files across the user's home directory. - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings when processing the trace content.
- Sanitization: The instructions do not mention sanitizing or escaping the content extracted from session traces before passing it to sub-agents.
- [COMMAND_EXECUTION]: The skill executes local Python scripts to perform its diagnostic tasks. These scripts are located in
~/.pi/agent/skills/tool-call-extract/scripts/and~/.pi/agent/skills/skill-call-extract/scripts/. While these are targeted to the agent's own infrastructure, they represent the execution of local files. - [DATA_EXFILTRATION]: The skill performs broad searches for
SKILL.mdfiles across~/.pi/agent/skills/and~/skills/. This allows the agent to read the definitions and frontmatter of all installed skills, which may contain sensitive configuration or operational metadata.
Audit Metadata