session-scan
Pass
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs sub-agents to execute a local Python script (
references/compute-metrics.py) to process session data. The execution uses standard subprocess calls with arguments (session-id, project, provider) derived from the session discovery process. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it ingests and processes untrusted data from previous session transcripts retrieved via the
ccridertool. - Ingestion points: Session transcripts are fetched from the
ccriderMCP and provided as input to sub-agents and the scoring script. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when passing transcript data to sub-agents.
- Capability inventory: The skill allows spawning sub-agents (
Agent(...)) and executing local Python scripts. - Sanitization: No explicit sanitization or filtering of the transcript content is performed before it is processed by the sub-agent or passed to the scoring script.
Audit Metadata