ClawHub
Back to skill

Security audit

session-handover

Security checks for vulnerabilities and agentic risk

Overview

This skill creates session handover notes, and its access to session history and durable notes is disclosed and aligned with that purpose.

Install this only if you want an agent to summarize local session state into durable handover notes. Review generated notes for secrets, personal data, stale decisions, and overbroad copied context before keeping or sharing them.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
## Recommended output

Write or update the appropriate durable handover note, normally `SESSION_NOTES.md`, a daily memory entry, or the active typed blackboard.

Use this compact shift sheet:
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to write durable session handover notes and memory artifacts, which creates a real risk of persisting sensitive user data, operational details, or credentials beyond the active session. In this context, the danger is increased because the skill encourages summarizing broad session state from histories, plans, receipts, service state, and memory files, making over-collection and accidental retention more likely.

Static analysis

No suspicious patterns detected.