session-inspector
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
erkCLI tool and executes subprocesses likeclaude --model haikufor semantic distillation of conversation logs. It also provides shell recipes for directory path calculation and log analysis.- [DATA_EXFILTRATION]: Facilitates the transfer of local session logs to GitHub via thecreate-pr-from-sessioncommand. While intended for collaboration, it involves uploading local conversation data to an external service.- [PROMPT_INJECTION]: Subject to indirect prompt injection risks as it processes untrusted data from session logs (~/.claude/projects/*.jsonl).- Ingestion points: Session logs are read from the filesystem bypreprocess-sessionandlist-sessions.- Boundary markers: The skill uses XML tags (e.g.,<user>,<assistant>) to structure output, but these do not prevent an LLM from following instructions embedded in the logs.- Capability inventory: Execution of CLI commands (erk,claude) and file writing to.erk/scratch/.- Sanitization: Performs 'mechanical reduction' to remove metadata, but lacks explicit sanitization or escaping of text content within the logs.
Audit Metadata