agent-session-batch-export
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted agent session transcripts which could contain malicious prompts from previous interactions.
- Ingestion points: Reads session data from
~/.claude/projectsand~/.codex/sessions(documented in SKILL.md and implemented in funnel.py). - Boundary markers: The skill maintains byte-identical copies of session files and does not wrap ingested content in security delimiters.
- Capability inventory: Accesses local filesystem for reading transcripts and writing curated corpora; uses shell utilities (jq, awk, sed) and Python for processing.
- Sanitization: Content extracted for TUI previews is sanitized for formatting, but the underlying session data remains unvalidated.
- [DYNAMIC_EXECUTION]: The skill generates and executes temporary helper scripts to facilitate user review.
- Evidence: Generates
open-review.sh(curate-sessions.sh) and.preview.sh(pick-sessions.sh) using hardcoded templates to provide an interactive interface for the user.
Audit Metadata