harvest-sessions
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes session transcripts from previous AI interactions, which constitutes untrusted external data. This creates a surface for indirect prompt injection where adversarial instructions embedded in past conversations could attempt to manipulate the agent during the harvesting phase.\n
- Ingestion points: Local conversation logs in
~/.claude/projects/and~/.codex/sessions/are read by thedigest_sessions.pyscript.\n - Boundary markers: The script produces structured digests using role markers like
[user]and[assistant]to provide context separation.\n - Capability inventory: The skill allows the agent to modify a specific repository (
secondbrain), perform git commits, and open pull requests via the GitHub CLI.\n - Sanitization: The script implements a comprehensive redaction mechanism using regex patterns to identify and mask common secret formats (e.g., API keys, tokens, and private keys) before the agent evaluates the content.\n- [COMMAND_EXECUTION]: The skill instructions involve executing local shell commands to facilitate the knowledge harvesting workflow.\n
- Evidence: The agent is instructed to run
python3,git, andghCLI commands to process transcripts and manage pull requests. These operations are scoped to the skill's primary function and include safeguards such as preventing direct commits to the main branch.
Audit Metadata