Security audit

claude-session

Security checks across malware telemetry and agentic risk

Overview

This is a real session-management skill, but it needs review because it can modify private session files and can automatically route session-derived content into agents, memory, or RAG stores.

Install only if you want an agent to manage local Claude session files and you are comfortable with it reading, moving, repairing, archiving, and sometimes deleting those files. Review the archive/import/analyze flows before use, especially any RAG, Serena memory, or agent-transfer behavior, and prefer dry-runs/backups before destructive commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 75% confidence
Finding: The manifest presents the skill as session management, but the documentation also includes additional operational capabilities such as extension-host restart behavior and extraction of task snapshots that are not clearly surfaced in the top-level description. That mismatch can cause users or reviewers to underestimate side effects, especially for actions that affect the IDE runtime or expose additional session-derived data.

Description-Behavior Mismatch

Medium

Confidence: 70% confidence
Finding: The documentation states that search and listing can target Antigravity/Gemini IDE session stores, but that cross-tool data access is omitted from the manifest description. Hidden support for additional data sources broadens the accessible corpus and can surprise users who expected the skill to operate only on Claude session data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documented 'Cross-Platform Migration' copies SQLite databases and brain artifacts from unrelated Gemini/antigravity application stores, which exceeds the stated Claude session-management scope and expands the trust boundary to additional local data stores. That creates a real risk of unintended access, transfer, or corruption of sensitive conversation data from other tools, especially if operators assume the skill only handles Claude sessions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: Although presented as 'Session Import,' the skill acts as a pipeline dispatcher that forwards session contents to other agents/skills. This broadens functionality from local session management to data exfiltration across agent boundaries, increasing the chance that sensitive conversation history is exposed to downstream tools with different permissions, retention, or logging behavior.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Allowing the user to specify any downstream agent means the skill can route full session context to an arbitrary target, with no evident trust validation or policy enforcement. In practice, this is a generic context-forwarding primitive that can leak confidential prompts, outputs, credentials, or business data to unintended agents or connectors.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: This section presents broken-chain detection/remediation examples that conflict with the file's own explicit invariant that parent links must not be repaired by previous file order. In a session-repair skill, contradictory instructions are dangerous because operators may follow the simpler example and silently rewrite conversation ancestry, corrupting history and inflating active context.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: These manual repair instructions directly tell the operator to set parentUuid from the previous line in file order, which the document itself states is an unsafe repair strategy. If used, this can splice unrelated branches together, alter effective session history, and permanently change what context appears reachable from the active leaf.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill exposes a destroy operation that deletes the current session and restarts the IDE, yet the topic listing does not prominently warn that the action is destructive and may be irreversible. In an agent setting, insufficient friction around destructive operations increases the chance of accidental invocation and permanent loss of session data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The purge topic says dead sessions are permanently deleted, but the documentation does not foreground the irreversibility or potential for false classification. Cleanup automation acting on session files without strong warning and confirmation can cause unintended data loss.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The direct destroy command example presents an immediately executable destructive command without an adjacent warning about permanent session loss. This is dangerous because users or agents may copy the command verbatim and trigger irreversible deletion and environment disruption with minimal contextual caution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `--sync` flow extracts project knowledge from session data and persists it to Serena memory, but the skill provides no explicit user-facing warning, consent step, or data-sensitivity review before writing potentially sensitive session-derived content. Because sessions can contain code, paths, decisions, and other internal context, this can cause unintended long-term retention or cross-context exposure of sensitive information.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documented procedure performs destructive local filesystem actions (`mv` of session files and an append to a ledger) but does not require an explicit user confirmation step immediately before modification. In an agent setting, this increases the risk of unintended data movement or metadata persistence if the skill is triggered on the wrong session or in an unexpected environment.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill describes a keyword-triggered fallback that auto-fires on very broad terms like 'session', 'rag', or 'qdrant'. This can cause the hook to run in unrelated conversations, unintentionally exposing session identifiers and transcript paths in contexts where the user did not explicitly request session inspection.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description immediately states that session data is delivered to other agents, but it does not present a prominent user-facing warning that this may expose private conversation contents beyond the original session boundary. Without clear disclosure, users may invoke the feature under the mistaken assumption that operations remain local and privacy-preserving.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The examples instruct operators to pass full conversation content into a subagent prompt without any safety interstitial, redaction step, or minimization guidance. Example code often becomes operational behavior, so this normalizes unsafe bulk-sharing of potentially sensitive transcripts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill includes direct deletion commands for session JSONL files and directories, but the documentation does not prominently warn that these actions permanently remove user conversation history and related artifacts. Because the feature is explicitly designed to manipulate real data under ~/.claude/projects/, an operator could trigger destructive cleanup with insufficient understanding, leading to accidental data loss.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: This skill explicitly moves session files between project directories and rewrites internal `cwd` references, but it does not present a clear safety warning about the destructive nature of those changes. In a session-management context, users may assume the command is administrative and reversible, increasing the chance of accidental data relocation, broken session linkage, or unintended modification of historical records.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The command block performs destructive in-place deletions on the session file, and the warning is not immediate or prominent enough at the point of use. In practice, users may copy-paste the commands without appreciating that line-based deletion can permanently remove session data or shift subsequent repair targets.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The duplicate-UUID removal example overwrites the live session file after filtering records, which can permanently discard data if the heuristic is wrong or the file is concurrently changing. Even with a backup step shown, the block lacks a clear warning that the operation is destructive and may remove semantically important records.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This example not only edits the live session file but does so by rewriting parent links in a way that can materially alter conversation history. Because the skill is specifically for session repair, users are likely to trust and apply the command, making the destructive effect more dangerous in context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The incorrect-split recovery instructions move and rewrite records across session files, including parentUuid and sessionId changes, without an explicit integrity warning at the command block. A user following this procedure can easily create cross-session corruption, broken lineage, or unrecoverable history gaps if the split index or new parent is wrong.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The hook automatically injects the current session ID and transcript path into model context based on prompt matching, without any runtime notice or consent signal to the user. This exposes internal metadata and file locations to downstream model behavior and any tools the model may invoke, increasing privacy and data-minimization risk if prompts are broad or if other skills consume that context unexpectedly.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The script reads the transcript file and extracts the last assistant model ID automatically, but does so silently and outside any visible user interaction. While this does not execute untrusted code, it does access local transcript contents and derives metadata that may be unnecessary for many requests, creating avoidable privacy exposure and hidden context flow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents a direct SQLite deletion workflow that irreversibly removes conversation steps, but it does not clearly warn that this can permanently destroy session history or corrupt related metadata if the target step or conversation reference is wrong. In a session-management skill, users are likely to copy-paste these commands, so omission of strong warnings and recovery guidance materially increases the chance of accidental data loss.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script prints session-derived fields such as titles and recent user messages directly to stdout, which can expose sensitive prompts, secrets, or personal data to terminals, logs, shell history captures, or calling automation without any warning or consent boundary. In this skill context, the tool is explicitly designed to inspect Claude session data, so the behavior is intentional, but it still creates a real data-exposure risk because session contents are often highly sensitive.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/batch-compress.py:28

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/repair-session.py:21

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test-repair-compact-boundary.py:28