Session History Retriever Clean

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:29 AM UTC
• Version: 1.0.0

Overview

This skill is intended to retrieve and reuse chat history, but it gives broad examples for copying, forwarding, and saving potentially sensitive session transcripts without enough safeguards.

Install only if you are comfortable letting the agent inspect and move prior conversation history. Before using it, review any transcript manually, avoid includeTools unless necessary, redact secrets and personal data, send only to an explicit session you trust, and avoid exporting history files unless you can store and delete them securely.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:89

Finding

Cross-Session History Access and Forwarding Lacks Explicit Authorization Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:89-95, SKILL.md:131-137, SKILL.md:169-176; equivalent workflows appear in README.md:41-47, README.md:51-57, and README.md:78-84
Vulnerability Type: Missing authorization and data-transfer safeguards for session history
Risk Level: Medium

Vulnerable Code Snippets

Session history, including tool-call information, can be retrieved directly:

bash

sessions_history --sessionKey agent:main:main --limit 50
sessions_history --sessionKey agent:main:main --limit 30 --includeTools=true

The documentation also instructs users to capture a transcript and pass the resulting history to another session:

bash

history=$(sessions_history --sessionKey agent:main:main --limit 20)
sessions_send --label <destination-label> --message <context-message> "$history"

Technical Analysis

The skill is specifically designed to enumerate sessions, retrieve their transcripts, and send historical content to another session. The documented workflow does not require verification that the caller owns or is authorized to access the source session. It also does not define a destination allowlist, recipient validation, sensitivity classification, redaction step, content preview, or explicit confirmation before transmission.

The --includeTools=true option increases the exposure risk because tool traces can contain internal paths, command output, operational metadata, credentials accidentally included in tool arguments, or other sensitive context not intended for another recipient.

Retrieved transcripts must also be treated as untrusted data. Historical messages could contain prompt-injection instructions. Importing them into another agent session without clearly delimiting them as inert quoted material may cause the receiving agent to interpret historical instructions as current commands.

The issue is an access-control and least-privilege weakness in t ...[truncated 1782 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the platform to verify that the caller is authorized to read the specified source session and send content to the selected destination.
2. Restrict access by default to sessions owned by the current user or agent. Require an explicit policy grant for group, channel, subagent, cron, or other users' sessions.
3. Require an explicit confirmation step that displays the source session, destination session, amount of history, and whether tool traces will be included.
4. Default includeTools to false. Permit tool-trace retrieval only when necessary and separately authorized.
5. Scan and redact credentials, authentication tokens, personal data, private keys, internal URLs, local paths, and other sensitive values before displaying or forwarding history.
6. Use a preview-and-approve workflow rather than directly passing the complete output of sessions_history into sessions_send.
7. Apply destination allowlists and prevent label-based routing unless the label resolves unambiguously to an authorized destination.
8. Mark imported transcripts as untrusted quoted data. Instruct receiving agents not to execute or follow instructions embedded in historical content.
9. Limit retrieval by message count, time range, and content type according to the minimum information required for the task.
10. Record source, destination, caller identity, retrieval options, redaction results, and confirmation state in tamper-resistant audit logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README encourages exporting and reusing session history without warning that chat logs may contain secrets, personal data, internal prompts, tool outputs, or other sensitive information. In a skill specifically designed to retrieve and import prior conversations, omission of privacy guidance increases the risk of accidental data leakage across sessions, files, or recipients.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Conflicting instructions inside a skill are dangerous because agents may follow the more concrete example rather than the earlier restriction. Here, the 'do not use for creating new sessions' warning is undermined by a later example that does exactly that, increasing the chance of unauthorized session creation and misuse of historical context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill says it is not for creating new sessions, yet later instructs using sessions_spawn. This contradiction can cause an agent to disregard safety and scope constraints, resulting in unintended session creation, context propagation, or actions occurring in a less visible execution path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation materially expands behavior beyond the declared scope by instructing use of additional tools such as sessions_spawn, session_status, memory_get, and local file export operations. This weakens operator expectations and can lead an agent to perform actions outside the reviewed capability boundary, including creating sessions or writing sensitive transcript data to disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The stated purpose is to find past conversations, review work progress, and import historical context into the current conversation. A '会话审计' scenario focused on checking token usage expands into operational monitoring rather than history retrieval or context import, which is not clearly justified by the manifest's purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest context and README positioning describe this skill as centered on sessions_list, sessions_history, and sessions_send for retrieving and importing session history. However, the usage example for '会话审计' introduces session_status, which is outside that stated tool set and contradicts the documented scope of the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The entire review report is written in Chinese, including headings, findings, and recommendations, while also describing an English-named skill. This can indicate a language/locale policy issue because the file imposes a specific language without any visible opt-in, alternative locale, or justification for why Chinese is required.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The report states under the scoring summary that the package '仅包含必要文件' and gives file purity a perfect score, yet earlier it marks .gitignore as '可选' and excludes it from the clean-version file list. This is a small but real documentation contradiction about what the intended package contents are.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.