review-ai-usage
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze transcript logs from various AI agents (Codex, Claude, Copilot, etc.). These logs contain untrusted natural language prompts and responses that could potentially contain malicious instructions intended to influence the agent performing the review.
- Ingestion points: Transcripts are collected from local directories such as
~/.claude,~/.codex,~/.cursor, and others in JSONL and SQLite formats (implemented insrc/ai_transcripts/sources/). - Boundary markers: The instructions in
SKILL.mdfor analyzing collected events do not include specific delimiters or instructions for the agent to ignore or treat the transcript content as untrusted data. - Capability inventory: The skill requires the agent to execute the
ai-transcriptsCLI tool, which has capabilities for local file system access (reading logs and writing to an Org-mode casebook). - Sanitization: Although the skill includes privacy-focused redaction for secrets, paths, and identifiers in the
export-learningscommand (seesrc/ai_transcripts/export.py), it lacks specific sanitization to neutralize potential instructions embedded within the transcript text during the analysis phase.
Audit Metadata