Back to skill

Security audit

Skill Usage

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a local usage-reporting tool, but it reads broad Claude conversation history files across projects to produce simple aggregate counts.

Review this skill before installing if your Claude history may contain confidential prompts, source code, secrets, or client data. It appears to process data locally and print only aggregate counts, but it does not give a clear pre-scan consent prompt or a way to limit scanning to selected projects or files.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
stats.py:53
Finding

Broad Access to Sensitive Claude Conversation History

Content
View full analysis
Dict[str, int]: """处理单个 JSONL 文件,返回技能计数""" counts = {} try: with open(file_path, "r", encoding="utf-8", errors="ignore") as f: for line in f: try: entry = json.loads(line) # 检查时间戳 if cutoff_ts is not None and "timestamp" in entry: ts = entry.get("timestamp") if isinstance(ts, (int, float)) and ts < cutoff_ts: continue # 检查 display 字段 if "display" in entry: display = entry.get("display", "") for skill, pattern in skill_patterns.items(): if pattern.search(display): counts[skill] = counts.get(skill, 0) + 1 except (json.JSONDecodeError, KeyError, TypeError): continue except (IOError, OSError): pass return counts def collect_stats(period: str) -> Dict[str, int]: """收集指定时间段的技能使用统计""" cutoff_ts = get_cutoff_timestamp(period) skills = get_installed_skills() skill_patterns = build_skill_patterns(skills) skill_counts = {skill: 0 for skill in skills} # 处理全局历史文件 history_file = Path.home() / ".claude" / "history.jsonl" if history_file.exists(): counts = process_file(history_file, skill_patterns, cutoff_ts) for skill, count in counts.items(): skill_counts[skill] = skill_counts.get(skill, 0) + count # 处理项目会话文件 projects_dir = Path.home() / ".claude" / "projects" if projects_dir ...[truncated 2573 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README explicitly states that the skill analyzes Claude conversation history from global and project JSONL files, but it does not clearly warn users that these files may contain sensitive prompts, code, secrets, or project data. This creates a real privacy risk because users may install and run the skill without understanding the scope of data access, especially given that it aggregates both personal and project-specific histories.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
allowed-tools:
  - Bash
  - AskUserQuestion
model: haiku
---

# 技能使用统计 (skill-usage)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs reading global and project conversation history files to compute usage statistics, but it provides no user-facing warning, consent step, or scope minimization. Those files can contain sensitive prompts, project details, and personal data, so silent analysis of them creates a real privacy risk even if the stated goal is benign analytics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code derives IS_ZH from the system default locale and then switches all user-visible report text between Chinese and English automatically. This is a natural-language policy concern because the user is not given an explicit language/locale choice or opt-in, and the behavior may override user preferences for the current session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The code recursively scans ~/.claude/history.jsonl and project JSONL session files, which can contain sensitive user activity metadata, without any user-facing notice, consent prompt, or scope control. In the context of a skill, silent collection of usage history increases privacy risk because users may not expect broad inspection of all project records just to render aggregate statistics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that the skill 'Automatically detects system language (Chinese/English)', which implies language is chosen automatically rather than offered as a user-controlled option. This can violate language/locale policy when no opt-in or override is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description text is in Chinese and the remainder of the skill instructions are also Chinese, effectively forcing a specific language for interaction and output. There is no opt-in, alternative language option, or justification that this is a region-specific skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.