agent-sessions
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill reads highly sensitive AI conversation history logs from multiple platforms, including Claude Code, Codex, Gemini, opencode, Hermes, and Cline, stored in user directories such as
~/.claude/,~/.gemini/, and SQLite databases. While this is the skill's primary purpose, it grants broad access to sensitive user data and past interactions. - [COMMAND_EXECUTION]: The skill executes external code via an absolute path for a Python script (
/Users/vladmdgolam/Play/radar/tools/agent-sessions) and runs other local binaries and applications likeclaude-historyandClaude Code History Viewer.app. These tools are not bundled with the skill, making their behavior unverifiable. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Historical chat logs in JSONL, JSON, and SQLite formats (SKILL.md).
- Boundary markers: None. The instructions do not define delimiters or provide warnings to the agent to treat historical content as untrusted data.
- Capability inventory: Includes the ability to execute shell commands for searching, reading, and resuming agent sessions.
- Sanitization: No evidence of sanitization or escaping for the message content retrieved from past sessions.
Audit Metadata