ClawHub
Back to skill

Security audit

session-replay

Security checks for vulnerabilities and agentic risk

Overview

The skill’s replay purpose is clear, but it can expose private Claude session history in a shareable GIF without enough privacy safeguards.

Review this skill carefully before installing. Use it only for sessions you are comfortable turning into a shareable artifact, prefer providing an explicit session path instead of browsing recent sessions, avoid including tools or thinking unless necessary, and inspect/redact the generated GIF before posting it anywhere.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Insufficient Protection Against Disclosure of Sensitive Session Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-81 and 103-108
Vulnerability Type: Sensitive information exposure through session discovery, parsing, and replay generation
Risk Level: Medium

Complete Code Snippet

markdown
### Step 0: Pick a Session (when no path is provided)

When the user invokes `/session-replay` without a path argument,
use `scribe.session_parser.list_sessions()` to discover recent
session files from `~/.claude/projects/`.

The function returns a list of `SessionInfo` objects sorted by
modification time (most recent first), each containing:

- `path` -- full path to the .jsonl file
- `modified` -- mtime timestamp
- `first_user_message` -- preview of the first human message
- `turn_count` -- number of user turns in the session
- `project_name` -- parent directory name

Present the list to the user as a numbered menu:

Recent sessions:

  1. [my-project] "implement auth module" (8 turns, 2h ago)
  2. [api-server] "fix rate limiting bug" (3 turns, 5h ago)
  3. [docs-site] "update installation guide" (12 turns, 1d ago)
text

Ask the user to pick a number. Use the selected session's
`path` for the remaining steps.

If `list_sessions` returns an empty list, report that no
sessions were found and suggest providing a path directly.

### Step 1: Parse the Session

Use `scribe.session_parser.parse_session()` to read the JSONL
file. The parser:

- Extracts user and assistant turns
- Skips sidechain (subagent) records
- Collapses tool calls into readable summaries
- Wraps text at the configured column width
- Truncates long responses at the configured row count

Apply filters based on user options:

- `--turns` selects specific turn ranges (e.g. `1-5`)
- `--show` controls which layers appear: `user`, `assistant`,
  `tools`, `thinking` (thinking is excluded by default)
markdown
### Step 3: Render GIF

Invoke `Skill(scry:vhs-recor
...[truncated 2947 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user approval before enumerating ~/.claude/projects/, and avoid displaying message previews unless separately authorized.
  2. Require explicit selection of a session file rather than automatically discovering session history, or constrain discovery to a user-approved project directory.
  3. Keep tools and thinking disabled by default. Display a prominent warning and obtain separate confirmation before including either layer.
  4. Add a pre-render review showing exactly which turns and layers will appear in the GIF.
  5. Scan extracted content for common secret formats, including API keys, access tokens, private keys, passwords, authorization headers, connection strings, and sensitive environment variables.
  6. Redact detected secrets and allow users to define additional project-specific redaction patterns.
  7. Require confirmation immediately before rendering, including the destination path and a warning that GIF contents may be publicly shareable and difficult to revoke.
  8. Create temporary files with restrictive permissions, unpredictable names, and exclusive creation semantics. Delete them on both success and failure.
  9. Validate and normalize user-provided input and output paths, and reject destinations outside user-approved directories where appropriate.
  10. Document that deletion of the temporary tape does not sanitize the generated GIF and advise users to inspect the final artifact before distribution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
Use `scribe.tape_generator.generate_tape()` to convert the
parsed turns into a VHS tape file. The generator:

- Creates the Output directive and Set commands
- Types user messages at 30ms/char with `$ ` prefix
- Types assistant responses at 15ms/char
- Types tool summaries at 100ms with two-space indent

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
Use `scribe.tape_generator.generate_tape()` to convert the
parsed turns into a VHS tape file. The generator:

- Creates the Output directive and Set commands
- Types user messages at 30ms/char with `$ ` prefix
- Types assistant responses at 15ms/char
- Types tool summaries at 100ms with two-space indent

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly enumerates recent session files from ~/.claude/projects/ and previews the first user message, but it provides no privacy warning or consent checkpoint before exposing potentially sensitive historical prompts. In this context, the omission materially increases the chance of unintentional disclosure of secrets, internal project names, or confidential user activity during interactive selection or replay generation.

Content

No source excerpt is available for this finding.