skill-recap
Warn
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill requires the agent to read sensitive local files containing session history. Evidence: The instructions specify reading transcript files from ~/.claude/projects/ and ~/.codex/sessions/. Impact: These transcripts contain private conversation history, including code and potentially sensitive user data. Accessing this history is a prerequisite for the skill's function but constitutes a significant data exposure risk.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data, creating a surface for indirect prompt injection. Ingestion points: Session and sub-agent transcripts read from the filesystem. Boundary markers: The instructions do not define delimiters or warnings to distinguish between transcript content and analysis instructions. Capability inventory: The agent can read local files, parse JSONL logs, and suggest platform commands like /to-tickets. Sanitization: No sanitization or filtering of transcript content is implemented.
Audit Metadata