Security audit

Cc Session Bridge

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built to bridge Claude Code sessions into AIMA, but it persistently records highly sensitive full session data without enough user controls or retention guidance.

Install only if you intentionally want Claude Code session contents to be recorded for AIMA. Run it from a least-privilege working directory, avoid repositories or folders containing credentials/customer data, review the generated ~/.openclaw session logs, and do not use it for sensitive workloads unless you add redaction and retention controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly states that it preserves full raw CC events, thinking, tool inputs, and complete result text, but the description does not prominently warn that sensitive prompts, secrets, internal reasoning, file contents, and tool outputs may be captured and persisted for AIMA visibility. In a session-bridging context, that omission is dangerous because the whole purpose is to export and retain potentially sensitive session data beyond the original execution environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation says that --cwd determines which files CC can access, but it does not present this as a security warning or advise users to avoid sensitive directories. Because the bridge then records CC activity and outputs, pointing --cwd at a secret-bearing project can lead to unintended reading and subsequent persistence of confidential files or derived data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script intentionally writes chat metadata, sender identifiers, and later raw CC events to persistent local session logs without any consent flow, minimization, or masking. In this skill context, the purpose is to bridge and collect sessions for AIMA, which makes silent retention of potentially sensitive conversational and operational data materially risky rather than incidental.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The script's stated design is to persist full conversation records and metadata into local JSONL files for later collection and display. In a bridge that captures model outputs, tool outputs, chat IDs, sender IDs, and task linkage, this creates a real confidentiality risk because sensitive data may be retained and later surfaced beyond its original audience.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The code and comments explicitly emphasize preserving complete raw events and full result text so that 'no data is lost,' which increases exposure of secrets, credentials, proprietary content, and internal tool data. Because this bridge is meant to export CC session data into another system, lossless capture materially amplifies the blast radius of any sensitive output produced during a session.

Ssd 3

High

Confidence: 99% confidence
Finding: Tool results are captured from arbitrary CC tool output and persisted, including large previews and aggregated snippets. Since tools may return file contents, credentials, environment details, customer data, or other secrets, storing and displaying those outputs in the bridge is a direct data-leak risk in this skill's telemetry/collection context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.