banana-claude-codex-import
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses private application data stored in the user's home directory to retrieve chat history and project metadata.
- Evidence: Accesses
~/.claude/history.jsonl,~/.claude/projects/*.jsonl, and~/.codex/sessions/**/*.jsonlvia the execution ofscripts/import_conversations.py. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from past chat logs and incorporates it into the agent's long-term memory (
MEMORY.md). This creates a vulnerability where instructions embedded in old logs could influence future agent behavior when the memory is retrieved. - Ingestion points: The script reads and parses local JSONL session files from Claude Code and Codex.
- Boundary markers: The script formats the data into markdown using headers (e.g., '👤 User', '🤖 Assistant') to separate messages, but it does not include explicit warnings to the agent to ignore instructions embedded within the imported text.
- Capability inventory: The skill has file system read access to sensitive home directory folders and write access to the workspace logs and memory directories.
- Sanitization: No content sanitization is performed on the imported messages to filter out potential injection patterns or malicious commands.
Audit Metadata