workflow-from-chats
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated chat transcripts, which presents an inherent surface for indirect prompt injection if transcripts contain malicious instructions. The skill addresses this by explicitly instructing the agent to exclude injected instructions and treat historical turns as evidence rather than commands.
- [DATA_EXPOSURE]: The skill accesses local AI session history directories at ~/.codex and ~/.claude. This access is integral to the skill's documented purpose, and the instructions include robust safeguards to ensure credentials and personal identifiers are excluded from the output and that sensitive data is handled in private temporary directories.
Audit Metadata