Nm Scribe Session Replay

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.2

Overview

This skill does what it says: it turns selected local Claude session logs into GIF replays, with a privacy risk users should manage before sharing outputs.

Before using this skill, assume the generated GIF may reveal anything visible in the selected Claude session, including prompts, code, file paths, tool summaries, and secrets. Use explicit session paths or narrow turn ranges, keep sensitive layers hidden, inspect the GIF before sharing it, and separately evaluate the required scribe/scry/VHS tooling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly operates on local Claude session JSONL files and renders their contents into a GIF, but it does not warn that those sessions may contain sensitive prompts, secrets, internal tool output, or other private conversation data. That omission increases the chance a user will replay and share confidential content without realizing the privacy implications.

VirusTotal

65/65 vendors flagged this skill as clean.