sessions
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes bundled shell and Python scripts (discover-sessions.sh, extract-metadata.py, extract-skeleton.py, extract-errors.py) to process local session logs. It also utilizes dynamic context injection (!git rev-parse) to resolve git branch and repository information at load time.
- [DATA_EXFILTRATION]: The skill reads sensitive agent session history files from specific directories (~/.claude/projects, ~/.codex/sessions, ~/.cursor/projects). While these contain historical logs, the skill implements guardrails to summarize findings and avoid exfiltrating raw tool calls or credentials.
- [PROMPT_INJECTION]: The skill serves as a surface for indirect prompt injection by processing historical session logs. Ingestion points include JSONL files in agent storage directories. While the synthesis prompt uses a structured schema and filter rules as boundary markers, and extraction scripts filter out reasoning blocks, the processed text content is not sanitized against adversarial instructions hidden in past logs. The skill capabilities include local script execution and subagent dispatch.
Audit Metadata