session-inspector

Pass

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the erk CLI tool and executes subprocesses like claude --model haiku for semantic distillation of conversation logs. It also provides shell recipes for directory path calculation and log analysis.- [DATA_EXFILTRATION]: Facilitates the transfer of local session logs to GitHub via the create-pr-from-session command. While intended for collaboration, it involves uploading local conversation data to an external service.- [PROMPT_INJECTION]: Subject to indirect prompt injection risks as it processes untrusted data from session logs (~/.claude/projects/*.jsonl).- Ingestion points: Session logs are read from the filesystem by preprocess-session and list-sessions.- Boundary markers: The skill uses XML tags (e.g., <user>, <assistant>) to structure output, but these do not prevent an LLM from following instructions embedded in the logs.- Capability inventory: Execution of CLI commands (erk, claude) and file writing to .erk/scratch/.- Sanitization: Performs 'mechanical reduction' to remove metadata, but lacks explicit sanitization or escaping of text content within the logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 1, 2026, 03:25 PM