daily-meeting-update
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
gh auth status,jira, andlsto detect existing integrations and project configurations within the development environment. - [COMMAND_EXECUTION]: The skill invokes a local Python script
claude_digest.pyto parse and summarize local Claude Code session history logs. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the
~/.claude/projectsdirectory to retrieve session history. This data is used strictly for generating the standup update and is only accessed after the user provides explicit consent during the interview phase. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external activity feeds (GitHub PRs, Jira tickets, and session history) and interpolates this content into the prompt context for the agent to summarize.
- Ingestion points: Command-line output from
gh,jira, and theclaude_digest.pyscript which reads local JSONL files. - Boundary markers: The skill relies on an interactive interview workflow where the user manually reviews and selects relevant items before the update is finalized.
- Capability inventory: Shell command execution and local file read operations.
- Sanitization: The provided Python script uses standard JSON parsing to extract specific fields from the log entries, providing a layer of structural validation.
Audit Metadata