review-ai-conversations
Warn
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to access and read sensitive local application data stores, including conversation logs and databases from multiple AI products.\n
- Evidence includes target paths such as
~/.claude/history.jsonl,state_5.sqlite(Codex),opencode.db, and project-specific transcript folders mentioned across thereferences/sources/directory.\n - While no explicit network exfiltration was found, the systematic access to comprehensive chat history across various tools represents a significant data exposure risk.\n- [PROMPT_INJECTION]: The skill processes untrusted data (past AI conversations) to perform summaries, extraction, and synthesis, which presents an indirect prompt injection surface.\n
- Ingestion points: Reads local history files and databases specified in the product adapter files (e.g.,
claude-code.md,codex.md).\n - Boundary markers: The
SKILL.mdfile instructs the agent to treat human messages as authoritative and AI replies as prior work, though it lacks technical delimiters to prevent the agent from obeying embedded instructions in the history.\n - Capability inventory: The skill possesses the capability to read local file systems and query SQLite databases using platform tools.\n
- Sanitization: There is no evidence of sanitization or filtering of the retrieved conversation text before it is processed by the agent.\n- [EXTERNAL_DOWNLOADS]: The
references/adapter-maintenance-evidence.mdfile contains numerous references to external GitHub repositories and documentation sites used for research.\n - It references official resources from well-known organizations including Anthropics, OpenAI, and Datadog.\n
- These references are provided for maintenance purposes and do not involve dynamic code execution or installation during normal operation.
Audit Metadata