cc-continue
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes various shell utilities including
node,awk,git, andmvto navigate directories, process transcript data, and manage session handoff files.\n- [REMOTE_CODE_EXECUTION]: The skill uses Python heredocs to dynamically generate and execute scripts at runtime. These scripts handle complex data extraction, JSON log parsing, and text reconstruction from raw transcripts.\n- [DATA_EXFILTRATION]: The skill accesses sensitive local conversation history and metadata stored in~/.claude/projects/and~/.claude/claude-code-token-saver-data/. While this access is the core functionality of the skill, it involves reading private session transcripts into the agent context.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by restoring previous session data into the current agent context.\n - Ingestion points: Reads transcripts from local
.jsonlfiles and preprocessed caches in the~/.claudedirectory.\n - Boundary markers: None; preprocessed session content is interpolated into the context without structural delimiters or explicit instructions to ignore embedded commands.\n
- Capability inventory: Local file system access, shell command execution, and dynamic Python script execution.\n
- Sanitization: None; transcript content is preprocessed for length and formatting but is not sanitized to detect or neutralize instructions embedded in historical messages.
Audit Metadata