dig
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It reads historical session data from .jsonl files in ~/.claude/projects/ and renders session summaries directly into the agent's context. If a previous session contains malicious instructions (e.g., in a message or a summary field), the agent may inadvertently follow them when processing the output of the /dig command.\n
- Ingestion points: scripts/dig.py parses all .jsonl files within the configured project directories.\n
- Boundary markers: The output is formatted as a Markdown table without explicit delimiters or warnings to the agent to ignore embedded instructions within the session summaries.\n
- Capability inventory: The skill possesses the ability to execute shell commands and read local files.\n
- Sanitization: The script truncates summaries to 80 characters, which provides minimal protection against payload execution but does not neutralize the threat.\n- [COMMAND_EXECUTION]: The skill performs shell command execution to determine the environment state and repository metadata.\n
- Evidence: SKILL.md uses ls, sed, and date to resolve project paths and timestamps. scripts/dig.py uses subprocess.run to call date for timezone detection and ghq for repository name resolution. These are standard system utilities used for their intended purposes.
Audit Metadata