session-bash-audit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/audit.pyfile usessubprocess.runto executegitcommands (ls-files, rev-parse, status). These operations are restricted to the skill's own installation directory to record the script's version information when saving baseline data. The calls do not useshell=Trueand do not process external input. - [INDIRECT_PROMPT_INJECTION]: The skill audits untrusted data from agent transcripts. 1. Ingestion points: JSONL transcripts in
~/.claude/projects/. 2. Boundary markers: Logic parses JSON blocks for tool results. 3. Capability inventory: Local file reads, local baseline writes, and local versioning git calls. 4. Sanitization: Script isolates command text for regex analysis using functions likestrip_heredocandstrip_quotedwithout executing the analyzed content. - [SAFE]: The skill accesses sensitive platform data, including session transcripts and configuration files in the
~/.claude/directory. This access is core to the skill's declared purpose of auditing agent behavior and is handled entirely locally with no network exfiltration identified.
Audit Metadata