T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:52
- Finding
- Insufficient Protection Against Disclosure of Sensitive Session Data## Vulnerability Details **File Location**: `SKILL.md`, lines 52-81 and 103-108 **Vulnerability Type**: Sensitive information exposure through session discovery, parsing, and replay generation **Risk Level**: Medium ### Complete Code Snippet ```markdown ### Step 0: Pick a Session (when no path is provided) When the user invokes `/session-replay` without a path argument, use `scribe.session_parser.list_sessions()` to discover recent session files from `~/.claude/projects/`. The function returns a list of `SessionInfo` objects sorted by modification time (most recent first), each containing: - `path` -- full path to the .jsonl file - `modified` -- mtime timestamp - `first_user_message` -- preview of the first human message - `turn_count` -- number of user turns in the session - `project_name` -- parent directory name Present the list to the user as a numbered menu: ``` Recent sessions: 1. [my-project] "implement auth module" (8 turns, 2h ago) 2. [api-server] "fix rate limiting bug" (3 turns, 5h ago) 3. [docs-site] "update installation guide" (12 turns, 1d ago) ``` Ask the user to pick a number. Use the selected session's `path` for the remaining steps. If `list_sessions` returns an empty list, report that no sessions were found and suggest providing a path directly. ### Step 1: Parse the Session Use `scribe.session_parser.parse_session()` to read the JSONL file. The parser: - Extracts user and assistant turns - Skips sidechain (subagent) records - Collapses tool calls into readable summaries - Wraps text at the configured column width - Truncates long responses at the configured row count Apply filters based on user options: - `--turns` selects specific turn ranges (e.g. `1-5`) - `--show` controls which layers appear: `user`, `assistant`, `tools`, `thinking` (thinking is excluded by default) ``` ```markdown ### Step 3: Render GIF Invoke `Skill(scry:vhs-recor ...[truncated 2947 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user approval before enumerating `~/.claude/projects/`, and avoid displaying message previews unless separately authorized. 2. Require explicit selection of a session file rather than automatically discovering session history, or constrain discovery to a user-approved project directory. 3. Keep `tools` and `thinking` disabled by default. Display a prominent warning and obtain separate confirmation before including either layer. 4. Add a pre-render review showing exactly which turns and layers will appear in the GIF. 5. Scan extracted content for common secret formats, including API keys, access tokens, private keys, passwords, authorization headers, connection strings, and sensitive environment variables. 6. Redact detected secrets and allow users to define additional project-specific redaction patterns. 7. Require confirmation immediately before rendering, including the destination path and a warning that GIF contents may be publicly shareable and difficult to revoke. 8. Create temporary files with restrictive permissions, unpredictable names, and exclusive creation semantics. Delete them on both success and failure. 9. Validate and normalize user-provided input and output paths, and reject destinations outside user-approved directories where appropriate. 10. Document that deletion of the temporary tape does not sanitize the generated GIF and advise users to inspect the final artifact before distribution.