worklog
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include Python code that performs file system operations, such as
os.listdir,glob.glob, andos.path.getmtime, to scan for recent session logs in the~/.claude/projects/directory. These operations are restricted to identifying relevant logs for the summarization task. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data consisting of previous conversation logs, which could contain instructions aimed at biasing the summary output.
- Ingestion points: The skill reads JSONL files from
~/.claude/projects/*/containing full session histories (Phase 1). - Boundary markers: Absent. There are no specific delimiters or warnings provided to the agent to distinguish between the log data and the generation instructions.
- Capability inventory: The skill has read access to Claude's local project session logs and write access to the local
worklog/directory in the current workspace (Phase 7). - Sanitization: The logic uses basic regular expression matching and string slicing (Phase 2) to extract snippets but does not implement comprehensive sanitization or validation of the ingested text.
Audit Metadata