ClawHub
Back to skill

Security audit

claude-session

Security checks for vulnerabilities and agentic risk

Overview

This session-management skill is mostly coherent, but it can automatically hand sensitive session archives to detected indexing receivers and installs persistent hooks/tools that affect private agent session data.

Install only if you are comfortable giving this skill broad access to local Claude/Gemini session transcripts. Before using archive/import/compress/destroy/migrate, confirm exactly which session file is targeted, disable or avoid automatic RAG dispatch unless you explicitly want indexing, review transcripts for secrets before sending them to another agent or store, and prefer pinned/reviewed MCP dependencies and backups before destructive operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
archive.md:53
Finding

Mandatory External Dispatch of Sensitive Session Data Without Affirmative Consent

Content
View full analysis
:`. File-move-only is correct **only** when no receiver is available **or** the user passed `--no-rag`. Run the 3-axis receiver scan **before reporting the archive result**: 1. **MCP server** — is a vector-store tool registered (`mcp____*-store` / `*-find`)? → candidate vendor skill 2. **Skill registry** — does a skill expose a RAG-store topic (e.g. `es6kr:qdrant-import`)? (MCP absent does not mean receiver absent) 3. **Reachability** — does the receiver endpoint answer (`curl -m 8 /healthz`)? Branch: - 0 receivers → file move only - 1 receiver reachable → **auto-supply `--rag=:`** (do not ask, do not present it as optional) - 2+ → AskUserQuestion to pick - Uncertain → ask; do not silently skip | 3 | Skip the 3-axis scan because the archive script has no `--rag` flag | Script lacking the flag → do the dispatch manually after the move (see the qdrant-import receiver). The scan + dispatch is still mandatory | #### Contract for receivers (vendor skills implement this) Caller (this skill) passes payload via environment variables; receiver skill chooses inline or file mode by which env vars are set: | Mode | Env va ...[truncated 2690 chars]
Remediation
View remediation
`. 2. Remove all instructions that prohibit asking for consent or automatically supply a receiver. 3. Before dispatch, show the exact destination, selected session, data volume, and whether full content or a summary will be transferred. 4. Require explicit confirmation immediately before any data leaves the local archive boundary. 5. Restrict receivers to an administrator- or user-maintained allowlist with authenticated identities. 6. Prefer transmitting a redacted, minimal summary instead of exposing the complete JSONL. 7. Scan for API keys, tokens, credentials, private keys, personal data, and internal URLs before transfer. 8. Do not provide arbitrary receivers with absolute local file paths. Read and sanitize the required content within trusted code, then pass a bounded payload. 9. Document receiver retention, encryption, deletion, and network-location properties. 10. Treat unavailable, ambiguous, or unverified receivers as a reason to perform local-only archival. ]]>

T01 · Skill Instruction Hijacking

Error
Location
import.md:47
Finding

Stored Prompt Injection Through Unsanitized Session Import

Content
View full analysis
{fetched session conversation content} ### Analysis Pipeline Task tool: subagent_type: "general-purpose" prompt: | Please analyze the following conversation: {session data} ### Custom Pipeline When the user specifies a particular agent/skill: Task tool: subagent_type: "{specified agent}" prompt: | Please work based on the following session context: {fetched session data} Request: {user's additional request} ``` ### Technical Analysis Historical session content is interpolated directly into the instruction prompt of another agent. The XML-like `` and `` delimiters are only text and do not enforce a security boundary. An imported transcript can contain adversarial instructions that tell the delegated agent to ignore its task, invoke tools, disclose data, modify files, or create persistent hooks. The templates do not tell the receiving agent that the embedded transcript is untrusted data, do not prohibit following instructions contained within it, and do not sanitize tool-call or control-like content. This creates a stored prompt-injection path because malicious instructions can remain dormant in a session until that session is imported. The `hookify` target increases the potential persistence impact because the delegated task is specifically asked to generate hooks. A malicious transcript could influence what future hook logic is proposed or created. ### Attack Path 1. An attacker causes adver ...[truncated 1114 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
compress.md:9
Finding

Unpinned Third-Party MCP Package Execution Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/destroy-session.sh:25
Finding

Session Destruction Uses an Unreliable Modification-Time Heuristic and May Overwrite Backups

Content
View full analysis
/dev/null | head -1) if [ -z "$LATEST_SESSION" ]; then echo "No session files found." exit 1 fi SESSION_ID=$(basename "$LATEST_SESSION" .jsonl) BAK_FILENAME="${PROJECT_FOLDER}_${SESSION_ID}.jsonl" echo "Deleting session..." echo " source: $LATEST_SESSION" echo " backup: $BAK_DIR/$BAK_FILENAME" # Move session file to backup directory mv "$LATEST_SESSION" "$BAK_DIR/$BAK_FILENAME" ``` ### Technical Analysis The script claims to destroy the currently active session but does not obtain or verify the current session UUID. Instead, it assumes that the most recently modified JSONL belongs to the active session. That assumption is unsafe when another IDE window, background process, synchronization tool, repair task, or concurrent Claude session updates a different file. The script can consequently remove an unrelated session from active storage. The destination filename is deterministic, and the script does not reject an existing destination or create a timestamped version. On platforms where `mv` replaces an existing destination, an earlier recovery copy can be overwritten. ### Attack Path 1. Two or more sessions exist in the current project directory. 2. Another process updates an unrelated session after the current session's last write. 3. The user invokes the destroy workflow believing it will target the current session. 4. `ls -t` selects the unrelated file because it has the newest modification time. 5. The script moves that file out of active storage. 6. If a backup with the same deterministic name exists, it may be replaced, reducing recoverability. An attacker with write access to the session directory ...[truncated 580 chars]
Remediation
View remediation
`. 5. Display the exact UUID and path and require confirmation before moving the file. 6. Refuse to operate if current-session identity cannot be established reliably. 7. Use a timestamped or collision-resistant backup filename. 8. Use no-clobber semantics or explicitly abort when the destination already exists. 9. Write an audit entry recording the source, destination, timestamp, and verified session UUID. 10. Add tests covering concurrent sessions, manipulated modification times, existing backups, and symlink targets. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (69)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Using AppleScript or System Events to automate editor/UI actions and restart an extension host crosses from session management into host-level control. Undocumented UI automation is dangerous because it can affect the local system outside expected session-file operations and may be abused to trigger unintended actions in the user's desktop environment.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
| list | Enumerate current-project sessions (UUID + mtime + size) | [list.md](./list.md) |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
| list | Enumerate current-project sessions (UUID + mtime + size) | [list.md](./list.md) |

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

bash
# Cross-project search by UUID
find ~/.claude/projects -name "<uuid>.jsonl"

Apply the script to the discovered path.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · archive.md (reported line 36)May include surrounding context.

bash
# Cross-project search by UUID
find ~/.claude/projects -name "<uuid>.jsonl"

Apply the script to the discovered path.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · clean-profanity.md (reported line 29)May include surrounding context.

bash
# Cross-project search by UUID
find ~/.claude/projects -name "<uuid>.jsonl"

Apply the script to the discovered path.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · clean-profanity.md (reported line 53)May include surrounding context.

bash
# Cross-project search by UUID
find ~/.claude/projects -name "<uuid>.jsonl"

Apply the script to the discovered path.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · compress.md (reported line 12)May include surrounding context.

md
Check whether the `mcp__claude-sessions-mcp__compress_session` tool is directly available (`ToolSearch("select:mcp__claude-sessions-mcp__compress_session")` or an equivalent tool-list check).

- **Available**: Proceed to step 2
- **Not available**: Register `claude-sessions-mcp` in the project's MCP config (`.mcp.json` or `~/.claude/settings.json` `mcpServers`) per `mcp-config` skill conventions, then retry the availability check

### 2. Remove Profanity (Optional)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · id.md (reported line 33)May include surrounding context.

md
Check whether the `mcp__claude-sessions-mcp__compress_session` tool is directly available (`ToolSearch("select:mcp__claude-sessions-mcp__compress_session")` or an equivalent tool-list check).

- **Available**: Proceed to step 2
- **Not available**: Register `claude-sessions-mcp` in the project's MCP config (`.mcp.json` or `~/.claude/settings.json` `mcpServers`) per `mcp-config` skill conventions, then retry the availability check

### 2. Remove Profanity (Optional)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · compress.md (reported line 37)May include surrounding context.

  1. Find target sessions: Search for session files containing hook-related messages

    bash
    grep -l -e '"hookEvent":"Stop"' -e '"type":"saved_hook_context"' ~/.claude/projects/<project_name>/*.jsonl

  2. Run compression on each session: Compress found sessions sequentially

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · destroy.md (reported line 55)May include surrounding context.

bash
# Search by unique text from the current conversation (first message recommended)
grep -l "{unique text from current conversation}" ~/.claude/projects/{project_name}/*.jsonl

Context Leakage

High
Category
Data Exfiltration
Confidence
88% confidence
Finding

The workflow explicitly extracts conversation content and then passes it to another agent via a task tool, which is a classic context-leakage path. In the context of session-management, this is particularly risky because session histories commonly contain credentials, proprietary code, internal decisions, and other high-sensitivity material accumulated over long conversations.

Content

Scanner excerpt · import.md (reported line 92)May include surrounding context.

md
## Full Workflow

1. Select project/session (`mcp__claude-sessions-mcp__list_*`)
2. Extract conversation content (`summarize-session.py`)
3. Identify pipeline target
4. Call agent via Task tool

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The documented use of rm on paths derived from variables enables destructive deletion if SOURCE_DIR or sid are incorrect, stale, or attacker-influenced. Because the skill operates on filesystem state under ~/.claude/projects, a misclassification, parsing bug, or path manipulation could permanently delete session data.

Content

Scanner excerpt · migrate.md (reported line 72)May include surrounding context.

[ -d "$SOURCE_DIR/$sid" ] && mv "$SOURCE_DIR/$sid" "$TARGET_DIR/$sid"

Delete tiny sessions

rm "$SOURCE_DIR/$sid.jsonl" [ -d "$SOURCE_DIR/$sid" ] && rm -r "$SOURCE_DIR/$sid"

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Recursive deletion of a directory built from variables is especially dangerous because a malformed or attacker-controlled sid/path can expand the blast radius beyond the intended session folder. Even when quoted, rm -r will irreversibly remove the target tree if earlier classification or path selection logic is wrong.

Content

Scanner excerpt · migrate.md (reported line 73)May include surrounding context.

Delete tiny sessions

rm "$SOURCE_DIR/$sid.jsonl" [ -d "$SOURCE_DIR/$sid" ] && rm -r "$SOURCE_DIR/$sid"

text

### 5. Report

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · migrate.md (reported line 73)May include surrounding context.

Delete tiny sessions

rm "$SOURCE_DIR/$sid.jsonl" [ -d "$SOURCE_DIR/$sid" ] && rm -r "$SOURCE_DIR/$sid"

text

### 5. Report

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · repair.md (reported line 162)May include surrounding context.

md
**Symptoms**:
- API Error 400: `The request body is not valid JSON: no low surrogate in string: line 1 column NNNNN`
- `jq` aborts mid-file with `parse error: Invalid \uXXXX\uXXXX surrogate pair escape at line N, column M`
- Manual `jq -c '...' session.jsonl > out` produces **silent truncation** — everything after the broken line is dropped without warning

**Causes**: Streaming response cut mid-character (network error, crash during write), Syncthing sync mid-write, or session file manipulation that split a multi-byte character.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/archive-session.sh (reported line 69)May include surrounding context.

sh
fi

# Locate the source file
SRC=$(find "$HOME/.claude/projects" -maxdepth 2 -name "${SESSION_ID}.jsonl" -type f 2>/dev/null | head -1)
if [[ -z "$SRC" ]]; then
  echo "ERROR: session not found anywhere under ~/.claude/projects: $SESSION_ID" >&2
  exit 1

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
94% confidence
Finding

The skill explicitly instructs searching under ~/.gemini/antigravity-ide/brain/..., which is an agent/application config area containing historical session transcripts. That creates a real data-exposure risk because invoking the skill can enumerate and read sensitive local session content outside the current project boundary, including prompts, tool outputs, secrets, or private workspace metadata.

Content

Scanner excerpt · search.md (reported line 37)May include surrounding context.

bash
# Search a single known session
grep -n "<keyword>" ~/.gemini/antigravity-ide/brain/<uuid>/.system_generated/logs/transcript.jsonl

# Search across all Antigravity brain sessions (unknown session ID)
for f in ~/.gemini/antigravity-ide/brain/*/.system_generated/logs/transcript.jsonl; do

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

The skill instructs reading raw session JSONL files from ~/.claude/projects/..., which is sensitive agent configuration/state storage and may contain conversation content, prompts, tool outputs, secrets, and metadata. Direct file access to this directory increases the blast radius of the skill and can expose private data beyond the minimum needed, especially if session identifiers or project names are influenced by user input.

Content

Scanner excerpt · split.md (reported line 42)May include surrounding context.

bash
# Extract user messages + timestamps
grep '"type":"user"' ~/.claude/projects/{project}/{session}.jsonl \
  | jq -r '[.timestamp, (.message.content[]? | select(.type=="text") | .text[:100])] | @tsv'

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/batch-compress.py:28

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/repair-session.py:21

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/test-repair-compact-boundary.py:28