Terminal Session Replay

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:16 PM UTC
• Version: 1.0.0

Overview

This skill does what it says: records, replays, exports, lists, and deletes terminal session recordings, with no hidden network, persistence, or privilege behavior found.

Install only if you are comfortable with terminal recordings being saved locally. Avoid recording passwords, tokens, production secrets, private customer data, or confidential command output, and review recordings before exporting or sharing markdown. On shared systems, check that ~/.terminal-sessions and exported files are private because the tool does not enforce restrictive permissions itself.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:17

Finding

Terminal Session Recordings Are Stored Without Enforced Private Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:17-20 and scripts/main.py:138-139
Vulnerability Type: Insecure permissions for potentially sensitive terminal recordings and metadata
Risk Level: Medium

Vulnerable Code

python

class TerminalSessionManager:
    def __init__(self, sessions_dir: Optional[str] = None):
        if sessions_dir:
            self.sessions_dir = Path(sessions_dir)
        else:
            self.sessions_dir = Path.home() / ".terminal-sessions"
        self.sessions_dir.mkdir(parents=True, exist_ok=True)

python

with open(paths['meta'], 'w') as f:
    json.dump(meta, f, indent=2)

Technical Analysis

The session directory and metadata files are created without explicitly enforcing owner-only permissions. Path.mkdir() and open() therefore rely on the process umask. The .typescript and .timing files are created by the inherited script subprocess under the same environment-dependent permission policy.

Terminal recordings can contain sensitive commands, credentials typed or displayed during a session, API tokens, filesystem paths, source code, and confidential command output. On a multi-user system with a permissive umask, or where ~/.terminal-sessions already has unsafe permissions, another local account may be able to enumerate or read these files.

The application also does not verify that an existing session directory is owned by the current user or that its permissions prohibit access by other users. Consequently, confidentiality depends on external host configuration rather than a security property enforced by the skill.

Attack Path

1. A victim runs the recording command and captures a terminal session containing sensitive commands or output.
2. The process uses a permissive umask, or the pre-existing ~/.terminal-sessions directory has group- or world-accessible permissions.
3. The tool creates metadata and invokes script without first enforcing restrictive director ...[truncated 1067 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the session directory with owner-only permissions and correct unsafe permissions on an existing directory:

python

self.sessions_dir.mkdir(parents=True, mode=0o700, exist_ok=True)
self.sessions_dir.chmod(0o700)

2. Verify that an existing session directory is owned by the current user before using it. Refuse operation when ownership is unexpected rather than silently trusting the path.

3. Create metadata files atomically with mode 0600, for example by using os.open() with O_CREAT | O_EXCL | O_WRONLY and an explicit permission mode:

python

fd = os.open(paths['meta'], os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
with os.fdopen(fd, 'w') as f:
    json.dump(meta, f, indent=2)

4. Ensure that the script subprocess creates .typescript and .timing files under a restrictive 077 umask. Where possible, pre-create output files securely or use a narrowly scoped subprocess setup that applies the restrictive umask.

5. After recording, verify that all generated files are regular files owned by the current user and enforce mode 0600.

6. Avoid following attacker-controlled symbolic links when creating or replacing session artifacts. Use exclusive and no-follow file creation primitives where the platform supports them.

7. Document that terminal recordings may contain secrets and advise users to review recordings before sharing or exporting them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes recording and exporting terminal sessions but does not warn that terminals often display or capture secrets such as passwords, API keys, tokens, internal hostnames, or confidential command output. In a documentation and sharing workflow, this omission can lead users to unintentionally store and redistribute sensitive data from ~/.terminal-sessions/ or generated markdown exports.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill advertises shell execution and file-writing behavior via python3 and script, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent or user may invoke a skill capable of recording sessions, creating files, and potentially affecting the local environment without clear policy constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill is specifically designed to capture full terminal sessions, which commonly include secrets such as access tokens, passwords pasted into prompts, internal hostnames, API responses, and proprietary commands. The documentation promotes recording, replaying, and exporting sessions but does not warn users about sensitive-data capture or advise safe handling, increasing the risk of credential leakage and unintended data exfiltration through exported markdown or shared recordings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The record function captures all terminal activity and persists it to disk, but it does not clearly warn users that secrets, credentials, tokens, commands, and command output may be recorded. In a debugging/sharing skill, that context makes the issue more dangerous because users are specifically encouraged to save and distribute session transcripts that may contain sensitive operational data.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 145)May include surrounding context.

python

# Execute script command
        try:
            result = subprocess.run(cmd)
            if result.returncode == 0:
                duration = self.get_session_duration(session_name)
                return {

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 188)May include surrounding context.

python

# Execute script command
        try:
            result = subprocess.run(cmd)
            if result.returncode == 0:
                duration = self.get_session_duration(session_name)
                return {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The export function writes full recorded terminal content into a markdown file without warning that sensitive material may be copied into a more shareable and durable format. Because the skill is meant for documentation and teammate sharing, this increases the likelihood of accidental disclosure of secrets, internal hostnames, personal data, or operational details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The delete operation unlinks all stored files for a session and immediately returns success, but there is no confirmation prompt, warning print, or explanatory comment indicating that this is destructive. Because the action permanently removes recorded data, it should provide some form of user disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown lists a delete command for removing a session, but provides no warning that this operation deletes stored recording artifacts from disk. For a user-facing skill description, destructive behavior affecting stored data should be disclosed so users understand the impact before invoking it.

Content

No source excerpt is available for this finding.