half-clone
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell utilities including
tail,jq,find, andsortto extract session metadata and locate scripts within the~/.claudeconfiguration directory. - [DYNAMIC_EXECUTION]: The skill performs runtime discovery of a local shell script (
half-clone-conversation.sh) using thefindcommand and subsequently executes it. This execution pattern relies on the script being present in the user's home directory and assumes the file's integrity. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with conversation history files, which serve as a source of untrusted data from previous session turns.
- Ingestion points: The skill reads metadata from
~/.claude/history.jsonlusingtailandjq(SKILL.md, Step 1). - Boundary markers: None identified; the instructions do not include specific delimiters or warnings to ignore instructions that might be embedded within the historical data.
- Capability inventory: The skill has access to shell execution (
bash,tail,find,jq) and the ability to execute identified local scripts. - Sanitization: The skill extracts specific JSON fields using
jqbut does not explicitly sanitize or validate the content of thesessionIdorprojectfields before they are passed as arguments to other commands.
Audit Metadata