The Agent Skills Directory

[COMMAND_EXECUTION]: The provided script scripts/query_sessions.py allows for querying local database files. It uses parameterized SQL queries for all user-provided inputs (such as session_id and directory), which prevents SQL injection vulnerabilities.
[DATA_EXFILTRATION]: The skill accesses a local application database (opencode.db) to perform its stated purpose. It lacks any network communication capabilities (no requests, urllib, or socket imports), ensuring that any data read from the database remains on the local file system.
[INDIRECT_PROMPT_INJECTION]: While the skill processes potentially untrusted session data, the export command generates HTML reports where all dynamic content from the database is correctly escaped using the html.escape() function. This mitigates risks associated with viewing malicious session history in a web browser.
[SAFE]: The script relies exclusively on the Python standard library and implements its forensic functionality with appropriate security measures, such as opening the database in read-only mode and sanitizing filenames for exported files.

session-forensics