Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because scanners report that it can select and export another conversation’s history outside the stated current-conversation purpose, with some scan coverage incomplete.
Consider the privacy implications before installing: the reported session fallback could include another project’s conversation in generated material, and transcript writing may occur when checks fail. The Skillspector scan was partial because some local references were unresolved, so the evidence is incomplete. The verdict is suspicious, not malicious; the results do not establish intentional harm.
scripts/extract_session.pySession lookup silently falls back to unrelated projects
Unrelated private conversation content enters the agent's context and the current workspace's source transcript without explicit selection. The normal workflow then uses that transcript to prepare shareable content. External publication or network exfiltration is not demonstrated.
External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
Path(os.path.abspath(html_path)).as_uri(),
]
try:
r = subprocess.run(cmd, timeout=timeout, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
except Exception as e:
return False, "浏览器截图异常: %s" % e
if not os.path.isfile(out_path):
The declared scope is the current conversation, but the extraction behavior can silently select another project's latest conversation when workspace matching fails. In a workflow producing publishable material, this can expose unrelated confidential discussions; prose-level redaction and eligibility checks do not establish authorization to access that conversation.
When the inferred workspace slug has no matching files, resolve_session searches the entire projects root and returns the most recently modified conversation without confirming its workspace or session identity. This crosses the requested conversation scope and can cause unrelated private history to be exported and incorporated into shareable content.
Without declared permissions the skill's intent is opaque and cannot be validated.
The --check flag is parsed but never used to suppress writes, and supplying --out-dir writes a transcript even when result['ok'] is false. Although this requires an explicit output-directory argument, callers relying on the documented check-only contract can unexpectedly persist sensitive conversation content or overwrite an existing transcript.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Path(os.path.abspath(html_path)).as_uri(),
]
try:
r = subprocess.run(cmd, timeout=timeout, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
except Exception as e:
return False, "浏览器截图异常: %s" % e
if not os.path.isfile(out_path):
Line 92 requires topic slugs to contain 3–5 lowercase English words and explicitly prohibits Chinese. This imposes a natural-language restriction on generated filenames without user opt-in or a documented justification; requiring filesystem-safe characters alone would not require English vocabulary.