session-atlas

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:04 PM UTC
• Version: 0.1.1

Overview

This is a disclosed local session-indexing skill, with the main cautions that its outputs contain private transcript content and its optional npx installer is unpinned.

Use this only on transcripts you are authorized to process, write indexes to a private directory, and do not commit or publish generated output. Prefer manual installation or direct script use, or pin and verify any npx-based installer before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Unpinned Network-Fetched npx Installer Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:5
Vulnerability Type: Unpinned third-party installer execution
Risk Level: Medium

Complete Code Snippet:

markdown

Requires Python 3.11+, no third-party Python dependencies. Install with `npx skills add AntreasAntoniou/session-atlas-agent-skill`, copy this folder to your agent's skill directory as session-atlas, or use scripts directly. The optional installer uses Node.js and network access.

Technical Analysis

The documented installation command invokes npx without specifying an exact version or integrity value for the skills package. If the package is not already available locally, npx may retrieve and execute its current release from the configured npm registry.

Consequently, the code executed during installation is mutable and is not part of the reviewed repository. A future malicious release, package-maintainer compromise, registry account compromise, or dependency compromise could alter installation behavior after this Skill has been audited. The documentation acknowledges network access, but it does not pin or cryptographically verify the downloaded executable.

The project also documents manual copying and direct script execution, which do not introduce this particular third-party installer risk.

Attack Path

1. An attacker compromises the npm package, its publishing account, or a transitive dependency used by the installer.
2. The attacker publishes a malicious version that retains plausible installation behavior while adding an arbitrary payload.
3. A user follows the documented unpinned npx skills add AntreasAntoniou/session-atlas-agent-skill command.
4. npx retrieves and executes the attacker-controlled package version.
5. The payload runs with the privileges of the user who launched the installer and may access resources available to that account.

Impact Assessment

Successful exploitation could permit arbitrary ...[truncated 537 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented manual-copy or direct-script installation methods as the default.
2. If npx remains supported, specify an exact audited package version, for example npx skills@<exact-version> ..., rather than resolving the latest release.
3. Use npm lockfiles and integrity metadata where installation is performed through a maintained wrapper project.
4. Document the expected npm package name, publisher, version, and integrity digest so users can verify package identity before execution.
5. Recommend running the installer in a least-privileged, isolated environment without unnecessary credentials or access to private transcripts.
6. Establish a release-review process for installer updates and re-audit whenever the pinned installer version changes.
7. Avoid install-time scripts or newly downloaded executable code where equivalent static installation is possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to install the skill via npx skills add AntreasAntoniou/session-atlas-agent-skill without pinning an exact package version or immutable source reference. If the upstream package is updated, hijacked, or a dependency is compromised, users may fetch and run unintended code during installation, which is more concerning here because the skill processes private session data and the README explicitly notes optional network access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of local scripts with file input, file output, and validation steps, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch increases the chance an agent will run shell and filesystem operations with broader access than intended, especially because the skill handles private session data and writes non-anonymized output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code writes a manifest, turn index, thinking coverage, and a markdown summary derived from a Claude session to disk. While the module docstring describes indexing, there is no user-facing prompt, print/log warning before writing potentially sensitive session-derived data, and the generated files include prompts, tool metadata, and source path information.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_atlas.py (reported line 62)May include surrounding context.

python

snapshot = base / "source.jsonl"
            snapshot.write_bytes(raw)
            fresh = base / "index"
            completed = subprocess.run([sys.executable, str(Path(__file__).with_name("index_claude_session.py")),
                                        "--source", str(snapshot), "--out-dir", str(fresh),
                                        "--snapshot-label", manifest["snapshot_label"]], capture_output=True)
            if completed.returncode:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_atlas.py (reported line 33)May include surrounding context.

python

]
    def index(self):
        self.source.write_text("\n".join(json.dumps(r) for r in self.records) + "\n")
        return subprocess.run([sys.executable, str(ROOT / "scripts/index_claude_session.py"),
                               "--source", str(self.source), "--out-dir", str(self.out)],
                              capture_output=True, text=True)
    def test_roundtrip_and_reasoning_not_reproduced(self):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_atlas.py (reported line 69)May include surrounding context.

python

validator.validate(self.out)
    def test_invalid_json_refused(self):
        self.source.write_text("not-json\n")
        result = subprocess.run([sys.executable, str(ROOT / "scripts/index_claude_session.py"),
                                 "--source", str(self.source), "--out-dir", str(self.out)], capture_output=True)
        self.assertNotEqual(result.returncode, 0)
        self.assertFalse((self.out / "snapshot-manifest.json").exists())