ClawHub
Back to skill

Security audit

session-atlas

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local session-indexing skill, with the main cautions that its outputs contain private transcript content and its optional npx installer is unpinned.

Use this only on transcripts you are authorized to process, write indexes to a private directory, and do not commit or publish generated output. Prefer manual installation or direct script use, or pin and verify any npx-based installer before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:5
Finding
Unpinned Network-Fetched npx Installer Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `README.md:5` **Vulnerability Type**: Unpinned third-party installer execution **Risk Level**: Medium **Complete Code Snippet**: ```markdown Requires Python 3.11+, no third-party Python dependencies. Install with `npx skills add AntreasAntoniou/session-atlas-agent-skill`, copy this folder to your agent's skill directory as session-atlas, or use scripts directly. The optional installer uses Node.js and network access. ``` ### Technical Analysis The documented installation command invokes `npx` without specifying an exact version or integrity value for the `skills` package. If the package is not already available locally, `npx` may retrieve and execute its current release from the configured npm registry. Consequently, the code executed during installation is mutable and is not part of the reviewed repository. A future malicious release, package-maintainer compromise, registry account compromise, or dependency compromise could alter installation behavior after this Skill has been audited. The documentation acknowledges network access, but it does not pin or cryptographically verify the downloaded executable. The project also documents manual copying and direct script execution, which do not introduce this particular third-party installer risk. ### Attack Path 1. An attacker compromises the npm package, its publishing account, or a transitive dependency used by the installer. 2. The attacker publishes a malicious version that retains plausible installation behavior while adding an arbitrary payload. 3. A user follows the documented unpinned `npx skills add AntreasAntoniou/session-atlas-agent-skill` command. 4. `npx` retrieves and executes the attacker-controlled package version. 5. The payload runs with the privileges of the user who launched the installer and may access resources available to that account. ### Impact Assessment Successful exploitation could permit arbitrary ...[truncated 537 chars]
Remediation
## Remediation Suggestions 1. Prefer the documented manual-copy or direct-script installation methods as the default. 2. If `npx` remains supported, specify an exact audited package version, for example `npx skills@<exact-version> ...`, rather than resolving the latest release. 3. Use npm lockfiles and integrity metadata where installation is performed through a maintained wrapper project. 4. Document the expected npm package name, publisher, version, and integrity digest so users can verify package identity before execution. 5. Recommend running the installer in a least-privileged, isolated environment without unnecessary credentials or access to private transcripts. 6. Establish a release-review process for installer updates and re-audit whenever the pinned installer version changes. 7. Avoid install-time scripts or newly downloaded executable code where equivalent static installation is possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The README instructs users to install the skill via `npx skills add AntreasAntoniou/session-atlas-agent-skill` without pinning an exact package version or immutable source reference. If the upstream package is updated, hijacked, or a dependency is compromised, users may fetch and run unintended code during installation, which is more concerning here because the skill processes private session data and the README explicitly notes optional network access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs use of local scripts with file input, file output, and validation steps, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch increases the chance an agent will run shell and filesystem operations with broader access than intended, especially because the skill handles private session data and writes non-anonymized output.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This code writes a manifest, turn index, thinking coverage, and a markdown summary derived from a Claude session to disk. While the module docstring describes indexing, there is no user-facing prompt, print/log warning before writing potentially sensitive session-derived data, and the generated files include prompts, tool metadata, and source path information.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
snapshot = base / "source.jsonl"
            snapshot.write_bytes(raw)
            fresh = base / "index"
            completed = subprocess.run([sys.executable, str(Path(__file__).with_name("index_claude_session.py")),
                                        "--source", str(snapshot), "--out-dir", str(fresh),
                                        "--snapshot-label", manifest["snapshot_label"]], capture_output=True)
            if completed.returncode:
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
    def index(self):
        self.source.write_text("\n".join(json.dumps(r) for r in self.records) + "\n")
        return subprocess.run([sys.executable, str(ROOT / "scripts/index_claude_session.py"),
                               "--source", str(self.source), "--out-dir", str(self.out)],
                              capture_output=True, text=True)
    def test_roundtrip_and_reasoning_not_reproduced(self):
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
validator.validate(self.out)
    def test_invalid_json_refused(self):
        self.source.write_text("not-json\n")
        result = subprocess.run([sys.executable, str(ROOT / "scripts/index_claude_session.py"),
                                 "--source", str(self.source), "--out-dir", str(self.out)], capture_output=True)
        self.assertNotEqual(result.returncode, 0)
        self.assertFalse((self.out / "snapshot-manifest.json").exists())
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_atlas.py:13