session-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads sensitive session history files located in the user's home directory, specifically
~/.claude/history.jsonland~/.codex/sessions/. While the intended purpose is to resume agent sessions, accessing these files exposes previous conversation history, environment paths, and potentially sensitive code or data discussed in those sessions. The scriptscripts/list_sessions.pyperforms these reads to display summaries to the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes and displays conversation history from external files (
history.jsonl,state.json) which could contain malicious instructions embedded in previous session data. - Ingestion points: Reads from
~/.claude/history.jsonland~/.codex/sessions/**/state.jsonviascripts/list_sessions.pyand the instructions inSKILL.md. - Boundary markers: The
SKILL.mdinstructions recommend presenting context in a 'clear format' but do not specify robust delimiters or instructions for the agent to ignore embedded commands within the history. - Capability inventory: The skill has the capability to read files and execute Python scripts, but does not currently write files or make network calls.
- Sanitization: There is no evidence of sanitization or escaping of the session content before it is re-injected into the current conversation context.
Audit Metadata