Lean Claude Code Harness

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.1

Overview

This is a documentation-only skill for designing a small auditable coding-agent harness, with a privacy note around its recommended transcript persistence.

Before installing or applying this skill, treat transcript persistence as a privacy-sensitive design choice: document where transcripts are stored, make retention and deletion clear, redact secrets, restrict file permissions, and allow users to disable or scope recording for sensitive sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94

Finding

Unconditional Persistence of Potentially Sensitive Session Transcripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 94–103
Vulnerability Type: Plaintext persistence of potentially sensitive session data
Risk Level: Medium

Vulnerable Code

markdown

### 6. Persist Every Session

Save transcripts to disk. Each transcript should include:

- session id
- timestamp
- prompt
- tool steps
- final response

Technical Analysis

The Skill directs implementers to save every session transcript to disk, including the prompt, tool activity, and final response. These fields can contain credentials, source code, personal data, environment details, filesystem contents, or other confidential information encountered during an agent run.

The guidance does not require user consent, secret redaction, output filtering, restrictive filesystem permissions, encryption, retention limits, secure deletion, or exclusion of sensitive tool results. An implementation that follows the instructions literally may therefore create a durable plaintext repository of sensitive information.

The issue is limited to insecure design guidance: this project contains no executable implementation that itself writes transcripts.

Attack Path

1. A user includes confidential information in a prompt, or an agent tool accesses sensitive local content.
2. The harness records the prompt, tool steps or results, and final response as directed.
3. The complete transcript is persisted to disk without mandatory redaction or storage protections.
4. Another local user, compromised process, backup operator, or later session with access to the transcript directory reads the stored content.
5. The exposed information is used to access affected accounts, repositories, systems, or private data, depending on what the transcript contains.

Impact Assessment

An attacker does not gain privileges directly from the Skill. However, readable transcripts may disclose secrets that enable subsequent unauthorized access with the privileges associated with ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

• Make transcript persistence explicitly configurable and opt-in where appropriate.
• Obtain informed user consent before retaining prompts and tool results.
• Redact API keys, passwords, tokens, private keys, authorization headers, and other recognized secrets before writing transcripts.
• Permit sensitive tools and individual tool results to be excluded from recording.
• Store transcripts in a documented, dedicated directory with restrictive owner-only permissions.
• Use encryption at rest when transcripts may contain confidential information, with keys stored separately from transcript files.
• Define retention periods, automatic expiration, and secure deletion behavior.
• Prevent transcript files from being committed to version control or included in broadly accessible diagnostics.
• Document whether backups and synchronization services may copy transcript data.
• Add tests verifying redaction, access permissions, retention, deletion, and disabled-persistence behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep